This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Issues with wildcards

I noticed that one of my rules stopped firing emails and upon digging around, I found that wildcards are not performing like they used too.  For example...

Say I have this log entry where the Event Info was:  "Member John Doe was added to group Domain Admins"

My rule would first off search for "Member*added to group*".  That does not work anymore.  I had to remove the "Member" for the rule to fire just off of "*added to group*".

Just now I was searching with nDepth and noticed the same.  I had an IP that I was searching for, say "*1.2.3.4*" and when doing a text search I found that the VPN user was in the format of "User jdoe assigned to IP 1.2.3.4", or something like that.  So, instead of searching for all instances of the IP, I edited my text search by adding "User*1.2.3.4*".  NDepth returned zero results.  I even tried it with a wildcard at the beginning like "*User*1.2.3.4*" and that still did not work...even though the search should have returned the results I modeled the search off of, at least!

From what I can tell, if you are trying to search for more than one set of text in a wildcard text search, you will get zero results.  So, you can search for "*one*", but not "*one*two*".  Hopefully, this gets resolved, because this was very handy.

Also, I know I can use the AND in nDepth, but it's very helpful to be able to note the order in which you want the text to be in the search.  Rather than displaying if it includes A and also includes B, you can only return results that include A before B (*A*B*) or B before A (*B*A*).

Parents
  • I tried this in my lab, and I was able to build filters and rules that would fire with multiple wildcards in the AIR console.  What version of LEM are you running?

    Thought I'd add more details on what I did to make sure it matched what you wanted.

    First, I created this rule, with pre-, mid- and suffix wildcards.  The rule ought to match my laptop anytime a process starts and stops.

    2013-11-14 09_45_02-SolarWinds Log and Event Manager Console.png

    Then I created this filter to look for my rule:

    2013-11-14 09_46_52-SolarWinds Log and Event Manager Console.png

    Again, to be sneaky, the filter has wildcards at the beginning, in the middle and at the end.  It should still match when my rule "Wildcards" fires, though.

    So, filter on and:

    2013-11-14 09_47_42-SolarWinds Log and Event Manager Console.png

    As you can see, the Wildcards filter (with Wildcards) see the Wildcard Rule (which has wildcards) is working and showing that the Rule is working too.  It's Wildcard inception!

Reply
  • I tried this in my lab, and I was able to build filters and rules that would fire with multiple wildcards in the AIR console.  What version of LEM are you running?

    Thought I'd add more details on what I did to make sure it matched what you wanted.

    First, I created this rule, with pre-, mid- and suffix wildcards.  The rule ought to match my laptop anytime a process starts and stops.

    2013-11-14 09_45_02-SolarWinds Log and Event Manager Console.png

    Then I created this filter to look for my rule:

    2013-11-14 09_46_52-SolarWinds Log and Event Manager Console.png

    Again, to be sneaky, the filter has wildcards at the beginning, in the middle and at the end.  It should still match when my rule "Wildcards" fires, though.

    So, filter on and:

    2013-11-14 09_47_42-SolarWinds Log and Event Manager Console.png

    As you can see, the Wildcards filter (with Wildcards) see the Wildcard Rule (which has wildcards) is working and showing that the Rule is working too.  It's Wildcard inception!

Children
  • I had some other issues with the upgrade where I had to create new queries instead of use my old ones.  Freezing issues and such.  Maybe these just need to be recreated.  I was able to modify these so that they worked by separating out the statements instead of using the multiple wildcards.  I bet it has to do with it being an old rule on the new upgrade.  I'm sure if I create a new rule instead of edit the old one, the multiple wildcards will start working.

    I had a call with support about the freezing issues and they said the old nDepth queries wouldn't work with the new version; this is where I get my assumption that this would have at least some issues with my multiple wildcard rules not working on the old rules.

    Thanks for taking a look at this though.