Alcatel-Lucent 7705 SAR, System Management Manual

Page: 271 / 356

Event and Accounting Logs
7705 SAR OS System Management Guide 271
entry
Syntax [ no ] entry entry-id
Context config>log>filter
Description
This command is used to create or edit an event filter entry. Multiple entries may be created using
unique
entry-id numbers. The TiMOS implementation exits the filter on the first match found and
executes the action in accordance with the action command.
Comparisons are performed in an ascending entry ID order. When entries are created, they should be
arranged sequentially from the most explicit entry to the least explicit. Matching ceases when a packet
matches an entry. The entry action is performed on the packet, either drop or forward. To be considered
a match, the packet must meet all the conditions defined in the entry.
An entry may have no match criteria defined (in which case, everything matches) but must have at least
the
action keyword for it to be considered complete. Entries without the action keyword will be
considered incomplete and rendered inactive.
The no form of the command removes the specified entry from the event filter. Entries removed from
the event filter are immediately removed from all log IDs where the filter is applied.
Default
No event filter entries are defined. An entry must be explicitly configured.
Parameters
entry-id — uniquely identifies a set of match criteria corresponding action within a filter. Entry ID
values should be configured in staggered increments so you can insert a new entry in an
existing policy without renumbering the existing entries.
Values
1 to 999
action
Syntax action { drop | forward }
no action
Context config>log>filter>entry
Description
This command specifies a drop or forward action associated with the filter entry.
If neither drop nor forward is specified, the default-action will be used for traffic that conforms to the
match criteria. This could be considered a No-Op filter entry used to explicitly exit a set of filter entries
without modifying previous actions.
When multiple action commands are entered, the last command will overwrite the previous command.
The no form of the command removes the specified action statement.
Default
no action