Article created by Tamsila-Q-Siddique.
1. You would at least need the Basic Edition of MonitorWare Agent / WinSyslog / EventReporter for this scenario.
Please Note: We are using MonitorWare Agent in this guide whereas MonitorWare Agent is superset of WinSyslog and EventReporter. So this guide is also applicable for WinSyslog and EventReporter.
2. In order to update a filter it’s necessary that you have a previously saved configuration in which you had applied filters. Click here if you wish to learn “How to add filters for database MonitorWare Agent, WinSyslog and EventReporter?”
Important note about Filter Condition
String comparison in Filter Conditions are “Case Sensitive”! For example, if the Source System name is “ws01” and you had written “WS01” while applying the filter, then this filter condition would “NEVER” evaluate to True! Please double check before proceeding further!
How to Delete Filters?
1. Lets say that initially we were interested in getting an e-mail alert in a given time period for the following filter condition:
( (Event ID is 500 OR 1000 OR 2000 OR 3000) ) AND ( FromHost is not equal to WS01 ) )
AND
( ( Event Source is equal to Security ) OR ( Priority is greater than 5 ) )
And the filter form looked like this:
2. Lets assume that you wish to delete some filter so the filter condition looks like:
( (Event ID is 500 OR 1000 OR 2000 OR 3000) ) AND ( FromHost is not equal to WS01 ) )
You would have to follow the following steps in order to accomplish this.
Deleting Filters One by One
This approach is recommended when you want to retain some part of the filter condition and to delete some part of the fiter in a more complex filter condition. Right Click on the filter property “Syslog Priority”, a pop up menu appears. Select delete from the menu.
Also delete the filter property “Event Source”. When you have deleted the filters, your screen should look as follows:
Deleting Filters Completely in a Single Selection
1. This approach is recommended when you don’t need the entire part of the filter condition. Right click on the OR and a pop up menu appears, select delete.
This process deletes the whole “OR” along with the filter conditions. When you have deleted the OR operation, your screen should look as follows:
2. Last, save the changes if you haven’t done it before and then restart the MonitorWare / WinSyslog or EventReporter service.
MonitorWare / WinSyslog or EventReporter cannot dynamically read changed configurations. As such,it needs to be restarted after such changes.