Windows filters

New versions of Logmanager 3.9.X cannot register newly installed WES agents. The development of the WES agent has been discontinued and replaced by the new Logmanager Beat Agent. The already installed/registered WES agents will continue to work. These are really just new installations of “old” WES agents, they are referred to as “legacy” or “deprecated”. We therefore recommend switching to the new Logmanager Beat Agents - Beat Agents.

Windows generates a large number of messages, which in most cases there is no need to store. Therefore, there is an option in the Logmanager system, how to filter these messages at the start, after coming to the Logmanager server and do not save it to the database. That option is Windows filters.

There are two basic options, how to work with filters. Either by using the positive logic, or by using negative logic. Rules can be set up so that will filter out unwanted messages and or will filter only messages that are not required and all the others will be discarded.

Filters defined in this section are used in the menu Sources ‣ Windows and in the menu Sources ‣ Windows Settings.

In the introductory table are available only information about the name of the filter (Name) You can add, edit or delete the filters.

By clicking on the plus icon will open the form with which you are able to create a new filter.

You must specify the following information:

• Name: filter name

• Chain: define the filter Events processing in blockly. After the build conditions you can perform two types of tests. The first button test send tests, how many messages will be stored into the Logmanager system, the second button test discard tests, how many messages will not be stored into the Logmanager system, and will be discarded.

  At the bottom under the visual designer displays the sample, which data will be stored and which will be discarded.

When you are finished, click on the Create button, to save data. By clicking on the Cancel button, the information is not saved and you will return back to the list of filters.

To edit an existing filter, click the pencil icon on the selected filter. In editing you can only change the condition, the name of filter you cannot.

Use the appropriate button to save or cancel the changes.

To delete an existing filter, click the cross icon on the selected filter. In the dialog box that pops up after clicking on the cross icon, confirm or cancel the deletion of the filter.

If the filter is applied on some client station or in global settings, the check will not allow its deletion. You must first remove the filter in assignments of the client stations in the menu Sources ‣ Windows, or in the menu Sources ‣ Windows Settings. After this, you can delete the filter.