Filtering for a Specific Event Class

Scenarios for Filtering Events › Filtering for a Specific Event Class

Filtering for a Specific Event Class

This scenario describes how to receive events of a specific class.

The Scenario

A security administrator needs to know about all events that have the class Security on all systems. The administrator wants the events to be sent by an eventlist to the workstation
admin.reo.dec.com.

One action, one filter and one dispatch are required. The action will use the eventlist action routine to dispatch the events.

Assume that the events, classes and serviced systems have already been created in the configuration database, and that the DECwindows Motif transport is TCP/IP.

The Solution

To set up the filtering mechanism for a specific event class, you would do the following:

Step	Action	For Command Line Interface	For C3 Interface
1.	Start the configuration editor	Starting the Configuration Editor in the chapter Modifying the Configuration Database	Starting the Configuration Editor in the chapter Modifying the Configuration Database
2.	Create an action with the following attributes: Name Enter Security Information Enter Security events on all systems Command Enter: CONSOLE$EVENTLIST Action Type Select the “ALL events and EACH userdata item” option Parameters To Pass Select Userdata only, deselect all others To Action	Adding Actions in the chapter Setting Up the ENS Components	Adding Actions in the chapter Setting Up the ENS Components
3.	Create a filter with the following attributes: Name Enter Security Information Enter Security events on all systems Events Deselect All Events Classes1 Deselect All Classes, and select only the Security class Systems Select All Systems Groups Select All Groups Subsystems Select All Subsystems Priorities Select All Priorities	Adding Filters and Dispatches in the chapter Setting Up the ENS Components	Adding Filters in the chapter Setting Up the ENS Components
4.	Create a dispatch for the filter with the following attributes: Action to Enter Security dispatch Information Enter Security events Userdata Enter admin.reo.dec.com 0 0 tcpip Select Execute at all Times on All Days	Adding Filters and Dispatches in the chapter Setting Up the ENS Components	Adding Dispatches for Your Actions in the chapter Setting Up the ENS Components

Compare these fields with the corresponding fields in the scenario described in the following section, Filtering for a Specific Event Priority. These two fields are the major functional differences between this scenario and the scenario described in Filtering for a Specific Event Priority.