MonitorWare Knowledge Base

[carteran]

Greetings,

Could someone help me with the syntax used in the exclusion text field of "Report options" which will exclude all events with a particular eventID from appearing in the report. I understand it has the form "EventID1-Keyword1". Will "EventID1 - *" or "EventID - " work, are wildcards supported. Perhaps the documentation for Monilog could be enhanced with some extensive examples as not all events of a particular class are relevant on some hosts.

Many thanks in advance
tony

[Guest]

Dear Tony,

You would have to use the following syntax if you want to exclude complete occurance of a specific event

EventID-

Example
682-

would remove ALL occurances of 682 from the report. Please note that in the above syntax there IS a space after the minus sign. So in the above example what actually it will do is that it will remove all the occurances of Event 682 from the report which have a space in their description. (Since the description of most of the events DO contain a space, it is likely to remove ALL occurances of specified Event ID

Similarly if you want to remove all occurances of event ID 600 and 700 then you would use the following syntax in the Report Options

600- ,700-
Once again note that there is a space after both - signs.

Hope this helps

Best Regards
Wajih-ur-Rehman
Adiscon

[agrigorof]

Just one word of caution here, it is better to exclude only specific instances of a certain event id as there are many sources that report the same event id but for different problems. One good example is event id 1000 - there could be hundreds of variation of this event.