The log manager uses event filter policies to allow fine control over which events are forwarded or dropped based on various criteria. Like other filter policies in the SR OS, filter policies have a default action. The default actions are either:
Forward
Drop
Filter policies also include a number of filter policy entries that are identified with an entry ID and define specific match criteria and a forward or drop action for the match criteria.
Each entry contains a combination of matching criteria that define the application, message, event number, router, severity, and subject conditions. The entry’s action determines how the packets should be treated if they have met the match criteria.
Entries are evaluated in order from the lowest to the highest entry ID. The first matching event is subject to the forward or drop action for that entry.
Valid operators are displayed in Table: Valid filter policy operators:
| Operator | Description |
|---|---|
eq |
equal to |
neq |
not equal to |
lt |
less than |
lte |
less than or equal to |
gt |
greater than |
gte |
greater than or equal to |
A match criteria entry can include combinations of:
Equal to or not equal to a specific system application.
Equal to or not equal to an event message string or regular expression match.
Equal to, not equal to, less than, less than or equal to, greater than or greater than or equal to an event number within the application.
Equal to, not equal to, less than, less than or equal to, greater than or greater than or equal to a severity level.
Equal to or not equal to a router name string or regular expression match.
Equal to or not equal to an event subject string or regular expression match.