1 Reply Latest reply on Mar 19, 2013 1:48 PM by nicole pauls

    Copy Rule to Monitor filter

    ttl

         How can I copy a Rule to a Monitor filter so I can see the matching criteria happening in real-time? When I try to recreate the criteria I'm only allowed 2 items in the Conditions group. Our Rule has two OR'ed groups of 3 AND conditions.

        • Re: Copy Rule to Monitor filter
          nicole pauls

          If your rule correlates multiple different types of events, you might have to look for the two types of events separately (or in the same filter) and then examine the timeframe yourself. Since filters are basically a "yes" or "no" question, they don't compare alerts to each other, they compare incoming alerts to a set of static criteria. Each alert is processed individually, dropped in the buckets, and forgotten about, whereas with rules you can look for one alert with another alert nearby within a certain timeframe.

           

          But, if your rule looks for a single type of event, you should be able to build up the same filter.