Configuring Filters- Making or Breaking the Work life Balance
Filters cut out all the messages that admins would rather not see on the display and stops email alarms from getting out of hand, when configured properly.
Per Kiwi Documentation, when No filters are applied, all messages are passed.
When this happens, especially on a large enterprise network, it gets ugly fast.
While it may seem useful to hear about every single event, every single spike, every single 1 second blip in service, it's just not.
What ends up happening is the people receiving the emails become numb to the shock value of seeing something happen and start to ignore the emails over time.
Getting an email that something an event has happened (for a good engineer) triggers an immediate need to handle the issue.
When the email notifications being sent are not actually actionable items that the engineers can trouble shoot and resolve, the alerts become pointless and the entire point of depending on the NMS system for useful information crumbles. Yes, that engineer especially if they're new, will go and spend on average of 20 minutes considering each email alert to see if there's a real issue to address.
Harvard Business wrote a piece on this which backs up the theory as well. In the article (there are many articles on this subject not just from Harvard Business) it states:
"For one thing, productive time is lost as employees deal with information of limited value. In the case of e-mail, effective spam filters have reduced this problem. Still, a survey of 2,300 Intel employees revealed that people judge nearly one-third of the messages they receive to be unnecessary. Given that those same employees spend about two hours a day processing e-mail (employees surveyed received an average of 350 messages a week, executives up to 300 a day), a serious amount of time is clearly being wasted."
From https://hbr.org/2009/09/death-by-information-overload
This isn't even considering the types of emails that Network Engineers get from SolarWinds and Kiwi or after hours’ emails. Please consider the latest studies on the effectiveness of filtering emails for the sanity of all who receive them.
If you're not sure what kinds of filters to set up, begin by looking at your most annoying emails, logs events, syslog, or trap events start with those. =o)
You can start simple:
You can go complex:
Inclusion and Exclusion Filter
When engineers want to get fancy, they use an Inclusion AND Exclusion Complex filter. It's just as easy to use, but sometimes just need to say the filter out loud to really see if it will make sense. Always test the function when all fields are filled in and upon successful execution, Save the settings.
If an engineer wants to get SUPER fancy, there is also a RegEx, "Filter Type". More on Regex can be found in Kiwi Documentation here under Configuring the Syslog Properties > Rules/Filters/Actions > Filter Types > Regular Expression Filter. http://www.kiwisyslog.com/help/syslog/index.html?gettingstartedwithkiwisysl.htm
I'm not yet a RegEx expert but I'm sure we have some in the community =o).
Other ways to Find Matches can be selected as well.
