Defining a Filter Condition

You define the filter conditions for the Event Filter property using the Filter Condition Editor.

To use the Filter Condition Editor

  1. In the navigation pane, select the Resource Monitor Policies, Windows node and then select the desired resource monitor policy.

  2. Select Event Logs.

  3. In the details pane, select the Event Filter property and click the ellipsis () button on the right.

    The Event Filter Editor appears.

  4. Click the New button to create a new filter condition, or click an existing filter condition and then click the Edit button to edit an existing filter condition.

    The Filter Condition Editor appears.

  5. Complete Step 1. EventLog is the only option and will be selected by default.

  6. Complete Step 2 in the Filter Condition Editor by selecting the properties of the event log you selected in Step 1 you want to filter on.

    Select the check box of the desired property or properties of the event log you want to filter on. As you select each check box, the property is added to the box in Step 3.

  7. Complete Step 3 in the Filter Condition Editor. This step allows you to enter the expressions used to test each event log. Each expression is essentially a rule you specify for filtering event logs against the property. You can create the rules using regular expressions or plain text, along with a comparison operator.

    Click the link () next to the property to specify the expression for filtering on this property.

    The Property Filter Editor appears.

  8. In the Property Filter Editor, complete the following steps:

    1. Select the comparison operator for the property filter.

    2. In the text box, enter a regular expression, plain text, or numbers (eventid).

      • If you want the text to be case-specific, select the use Case Sensitive comparison check box.

      • If you use a regular expression, select the use Regular Expression check box. You can also click the link next to this check box to display examples of regular expressions.

  9. Click OK to close the Property Filter Editor.

  10. Repeat steps 6, 7, and 8 to add additional filter conditions.

  11. Click OK to close the Filter Condition Editor.

  12. In the Event Filter Editor, enable or disable the filter conditions you just defined.

    • To enable a filter condition, select the check box next to the desired filter condition.

    • To disable a filter condition, clear the check box next to the filter condition.

  13. Click OK to close the Event Filter Editor, or New to create additional filter conditions.

    You can view the filter conditions you specified in the Event Filter property, which appear in the form of Boolean expressions.

  14. Save your changes.