Windows filters
New versions of Logmanager 3.9.X cannot register newly installed WES agents. The development of the WES agent has been discontinued and replaced by the new Logmanager Beat Agent. The already installed/registered WES agents will continue to work. This really only applies to new installations of “old” WES agents, they are referred to as “legacy” or “deprecated”. We therefore recommend switching to the new Logmanager Beat Agents - Beat Agents.
Windows generates a large number of messages, which in most cases there is no need to store. Therefore, there is an option in the Logmanager system to filter these messages at the beginning, right after coming to the Logmanager server, and to not save them to the database. That option is Windows filters.
There are two basic options, how to work with filters. Either by using the positive logic, or by using negative logic. Rules can be set up to filter out unwanted messages, or to only keep the wanted messages and discard the rest.
Filters defined in this section are used in the menu Sources ‣ Windows and in the menu Sources ‣ Windows Settings.
In the introductory table, only the information about the name of the filter (Name) is available. You can add, edit or delete the filters.
By clicking the plus icon, the form will open with which you are able to create a new filter.
You must specify the following information:
-
Name: filter name
-
Chain: define the filter Events processing in blockly. After the build conditions you can perform two types of tests. The first button test send tests, how many messages will be stored into the Logmanager system, the second button test discard tests, how many messages will not be stored into the Logmanager system, and will be discarded.
At the bottom under the visual designer displays the sample, which data will be stored and which will be discarded.
To edit an existing filter, click the pencil icon by the selected filter. When editing, you can only change the condition, the name of filter cannot be changed.
To delete an existing filter, click the red cross icon on the selected filter.
If the filter is applied on a client station or in global settings, the check will not allow its deletion. You must first remove the filter in assignments of the client stations in the menu Sources ‣ Windows, or in the menu Sources ‣ Windows Settings. After this, you can delete the filter.