H3C Technologies H3C Intelligent Management Center - Manual (Page 694)

680
Adding a Syslog filtering rule
To add a Syslog filtering rule:
1. Navigate to Filtering Rule:
a. Click the Alarm tab from the tabular navigation system on the top.
b. Click Syslog Management on the navigation tree on the left.
c. Click Filtering Rule under Syslog Management from the navigation system on the left.
2. Click Add to enter the Add Rule page.
3. Enter a name for the filtering rule in the Rule Name field.
The rule name must be unique and a valid length for the rule name is 1-256 characters.
4. Set the status of the filtering rule.
The status of the filtering rule can be modified.
• Disabled—Disables the filtering rule. After the filtering rule is added, it does not take effect.
• Enabled—Enables the filtering rule. After the filtering rule is added, it immediately takes effect.
5. Enter a brief description for the filtering rule in the Rule Description field.
6. Select target devices for the filtering rule by using one of the following methods:
{
Enter the IP addresses of a device in the Device IP field, and then click Add to add the IP address
to the Target Devices field.
{
Click Select to select one or more devices from the Select Devices popup window.
For more information, see " Adding devices by View " and " Adding devices by Advanced query ."
To delete a device from the Target Devices field, select the device from the Target Devices field and
then click Delete.
To add multiple devices, repeat the operation by using one of the above methods.
7. Select a matching rule from the Matching Order list.
• Keep Keyword Order—Keeps the keyword order. For example, set three keywords in the order of A,
B, and C for the filtering rule. To match the filtering rule, the Syslog entries must have the three
keywords and the three keywords must appear in the order of A, B, and C.
• Ignore Keyword Order—Ignores the keyword order. For example, set three keywords in the order of
A, B, and C for the filtering rule. To match the filtering rule, the Syslog entries only need to have the
three keywords regardless of the order of the keywords.
8. Enter keywords for the filtering rule.
a. Enter keywords in the field under Keywords.
b. Click Add in the Action list to add multiple keywords.
If you entered multiple keywords, Delete appears to the right of Add. To delete a keyword, click
Delete associated with the keyword.
9. Click OK.
Modifying a Syslog filtering rule
To modify a Syslog filtering rule:
1. Navigate to Filtering Rule:
a. Click the Alarm tab from the tabular navigation system on the top.
b. Click Syslog Management on the navigation tree on the left.
c. Click Filtering Rule under Syslog Management from the navigation system on the left.