Technology > Features > Management > Event Filtering

Event Filtering

You can’t monitor events in real time, or analyze event history, without filtering. AggreGate users may create and manage event filters. A Filter is owned by whoever created it, but may be shared between users due to the flexible permissions setup.

Events may be filtered by:

• Source (device, a group of devices, system resource, or a group of resources).
• Event type.
• Minimal level (severity).
• Filtering expression used for fine-grained filtering.
  

Filtering by expression makes event filters extremely flexible. Here are just some examples of how it may help:

• Finding events fired within a specific date/time range.
• Finding Login events of a specific user (i.e. filtering by username).
• Finding all events that contain a certain substring in any of their data fields.

	Event Filter

• Finding all temperature alerts raised when temperature was higher than 120 degrees.
• Filtering events matching condition X and/or condition Y, or more complex combinations.

In addition to the selection criteria, filters include presentation rules:

• Visibility of event's basic parameters, i.e. source, type, level and acknowledgements.
• Visibility of individual event-specific fields.
• Custom expression-based and level-based highlighting rules.

A filter can be made to prompt an operator for certain parameters every time it is activated.

AggreGate Server distribution includes a set of built-in commonly used filters for viewing all major system events, device events, etc.