Event triggers are created under the config>log>event-trigger context. Each event trigger is associated with an application and event ID. One or more trigger entries can be configured for the event.
Each trigger entry references a previously configured event handler (which references a configured script policy, which in turn references the script that should be run). A trigger entry can be configured with a previously configured log filter. If a filter is configured, the event trigger calls the filter to determine whether the event should be dropped or forwarded. If the event is to be forwarded, the event trigger invokes the event handler.
All log filter matching options are supported. Regexp matching is supported. Complex rules can be configured to match on log events as a trigger for an EHS event handler.
The EHS triggers on log events that are dropped by user-configured log filters that are assigned to individual logs (with the config>log>log-id>filter command). The EHS event trigger occurs before the distribution of log event streams into individual logs.
If there is no filter configured for the trigger entry, the event trigger invokes the event handler as soon as the event occurs.
Log events can be configured to be suppressed or throttled (with the config>log>event-control command). EHS does not trigger on suppressed or throttled events.