Novell SENTINEL LOG MANAGER 1.0.0.5 - 03-31-2010, Руководство администратора

Страница: 112 / 168

112 Sentinel Log Manager 1.0.0.4 Administration Guide
no
vd
ocx
(e
n)
19
Fe
bru
a
ry
20
10
4 Specify a name for the rule.
5 Specify a filter value. The filter value can be the same value required to perform a search.
Click the
show tips link to use the tag names defined in the table for defining rule filter. For
example, to define a rule that applies to all events with a severity of 3 or 5 use sev:[3 TO 5 ].
6
Select an action to be performed on every event that meets the filter criteria. The list of
available actions in the drop-down list is determined by the defined actions. Actions are created
and configured individually.
For more information about how to add, modify, and delete actions, see
“Configuring Actions”
on page 114 .
For each selected action, information is displayed to indicate where this action will send events.
The information comes from the configuration details for the action.
7 Click icon to select additional actions to be performed.
8
Click to remove the selected action for this rule.
9 Click Save to save the rule.
The newly created rule appears under the Rules tab.
7.1.3 Editing a Rule
1
Log in to the Sentinel Log Manager as an administrator.
2 Click rules in the upper left corner of the page.
3
The Rules tab is displayed on the right pane of the page.
The created rules appear on the page.
4
Click the edit link next to the rule to change a rule definition.
5 Click Save to save the settings.
If the rules settings are changed, a
Successfully Saved Rule
message is displayed.
7.1.4 Ordering Rules
When there is more than one rule, the rules can be reordered by using drag-and-drop. Events are
evaluated by rules in the specified order until a match is made, so you should order rules
accordingly. More narrowly defined rules and more important rules should be placed at the
beginning of the list.
1 Log in to the Sentinel Log Manager as an administrator.