Extreme Networks ExtremeWare XOS 11.1, Руководство пользователя

Страница: 137 / 496

Event Management System/Logging
ExtremeWare XOS 11.1 Concepts Guide
137
The first step is to create the filter using the
create log filter
command. You can create a filter
from scratch, or copy another filter to use as a starting point. (It may be easiest to copy an existing filter
and modify it.) To create a filter, use the following command:
create log filter <name> {copy <filter name>}
If you create a filter from scratch, that filter initially blocks all events until you add events (either the
events from a component or a specific event condition) to pass. You might create a filter from scratch if
you want to pass a small set of events and to block most events. If you want to exclude a small set of
events, use the default filter that passes events at or above the default severity threshold (unless the
filter has been modified), named
DefaultFilter , that you can copy to use as a starting point for your filter.
After you create your filter, you configure filter items that include or exclude events from the filter.
Included events are passed; excluded events are blocked. To configure your filter, use the following
command:
configure log filter <name> [add | delete] {exclude} events [<event-condition> | [all
| <event-component>] {severity <severity> {only}}]
For example, if you create the filter myFilter from scratch, then issue the following command to include
events:
configure log filter myFilter add events stp
All STP component events of at least the default threshold severity passes myFilter (for the STP
component, the default severity threshold is
error
). You can further modify this filter by specifying
additional conditions. For example, assume that myFilter is configured as before, and assume that you
want to exclude the STP.CreatPortMsgFail event. To add that condition, use the following command:
configure log filter myFilter add exclude events stp.creatportmsgfail
You can also add events and subcomponents to the filter. For example, assume that myFilter is
configured as before, and you want to include the STP.InBPDU subcomponent. To add that condition,
use the following command:
configure log filter myFilter add events stp.inbpdu
You can continue to modify this filter by adding more filter items. The filters process events by
comparing the event with the most recently configured filter item first. If the event matches this filter
item, the incident is either included or excluded, depending on whether the
exclude
keyword was
used. if necessary, subsequent filter items on the list are compared. If the list of filter items is exhausted
with no match, the event is excluded and is blocked by the filter.
To view the configuration of a filter, use the following command:
show log configuration filter {<filter name>}
The output produced by the command (for the earlier filter) is similar to the following:
Log Filter Name: myFilter
I/ Severity
E Comp. Sub-comp. Condition CEWNISVD
- ------- ----------- ----------------------- --------
I STP InBPDU --------
E STP CreatPortMsgFail -E------
I STP --------
Include/Exclude: I - Include, E - Exclude