Adding a New Policy

To add a new policy, do the following:

  1. Click on the Click here hyperlink available just above the test configuration of the Application EventLog test, Application Events test, System Events test, System EventLog test, or Security Log test (see Figure 54).

    1-FINAL

    Figure 54 : Configuring an ApplicationEvents test

  2. Figure 55 will then appear listing the policies that pre-exist.

    2-FINAL

    Figure 55 : List of policies

  3. To view the contents of a policy, click on the View button against the policy name. While a policy can be modified by clicking on the Modify button, it can be deleted using the Delete button. The default policy is all, which can only be viewed and not modified or deleted. The specification contained within this policy is: all:none:all:none:all:none.
  4. To create a new policy, click on the Add New Policy button in Figure 55. Doing so invokes Figure 56, using which a new policy can be created.

    3-FINAL

    Figure 56 : Adding a new filter policy

  5. In Figure 56, first, provide a unique name against POLICY NAME.
  6. To include one/more event sources for monitoring, select Included from the EVENT SOURCES drop-down list, and then specify a comma-separated list of event sources in the adjacent text box. If you require more space to specify the event sources, click on the View button next to the text box. This will invoke an EVENT SOURCES INCLUDED text area (see Figure 57), wherein the specification can be provided more clearly and comfortably.

    4-FINAL

    Figure 57 : Viewing the text area

  7. To exclude specific event sources from monitoring, select Excluded from the EVENT SOURCES drop-down list, and then specify a comma-separated list of event sources to be excluded in the adjacent text box. If you require more space to specify the event sources, click on the View button next to the text box. This will invoke an EVENT SOURCES EXCLUDED text area, wherein the specification can be provided more clearly and comfortably.

    Note:

    At any given point in time, you can choose to either Include or Exclude event sources, but you cannot do both. If you have chosen to include event sources, then the eG Enterprise system automatically assumes that no event sources need be excluded. Accordingly, the {event_sources_to_be_excluded} section of the filter format mentioned above, will assume the value none. Similarly, if you have chosen to exclude specific event sources from monitoring, then the {event_sources_to_be_included} section of the format above will automatically take the value all, indicating that all event sources except the ones explicitly excluded, will be included for monitoring.

  8. In the same way, select Included from the EVENT IDS list and then, provide a comma-separated list of event IDs to be monitored. For more space, click on the View button next to the text box, so that an EVENT IDS INCLUDED text area appears.
  9. If you, on the other hand, want to exclude specific event IDs from monitoring, then first select Excluded from the EVENT IDS list box, and then provide a comma-separated list of event IDs to be excluded. For more space, click on the View button next to the text box, so that an EVENT IDS EXCLUDED text area appears.

    Note:

    At any given point in time, you can choose to either Include or Exclude event IDs, but you cannot do both. If you have chosen to include event IDs, then the eG Enterprise system automatically assumes that no event IDs need be excluded. Accordingly, the {event_IDs_to_be_excluded} section of the filter format mentioned above, will assume the value none. Similarly, if you have chosen to exclude specific event IDs from monitoring, then the {event_IDs_to_be_included} section of the format above will automatically take the value all, indicating that all event IDs except the ones explicitly excluded, will be included for monitoring.

  10. Likewise, select Included from the EVENT DESCRIPTIONS list and then, provide a comma-separated list of event descriptions to be monitored. For more space, click on the View button next to the text box, so that an EVENT DESCRIPTIONS INCLUDED text area appears.
  11. For excluding specific event descriptions from monitoring, first select Excluded from the EVENT DESCRIPTIONS list box, and then provide a comma-separated list of event descriptions to be excluded. For more space, click on the View button next to the text box, so that an EVENT DESCRIPTIONS EXCLUDED text area appears.

    Note:

    • Instead of the complete event descriptions, wild card-embedded event description patterns can be provided as a comma-separated list in the Included or Excluded text boxes. For instance, to include all events that start with st and vi, your Included specification should be: st*,vi*. Similarly, to exclude all events with descriptions ending with ed and le, your Excluded specification should be: *ed,*le
    • At any given point in time, you can choose to either Include or Exclude event descriptions/users, but you cannot do both. If you have chosen to include event descriptions/users, then the eG Enterprise system automatically assumes that no event descriptions/users need be excluded. Accordingly, the {event_descriptions_to_be_excluded} section or the {users_to_be_excluded}  section (as the case may be) of the filter formats mentioned above, will assume the value none. Similarly, if you have chosen to exclude specific event descriptions/users from monitoring, then the {event_descriptions_to_be_included} section or the {users_to_be_included} section (as the case may be) of the formats above will automatically take the value all. This indicates that all event descriptions/users except the ones explicitly excluded, will be included for monitoring.
  12. In case of the Security Log test however, you will not be required to include/exclude event descriptions. Instead, an event users field will appear, using which you need to configure users who need to be included/excluded from monitoring.
  13. Finally, click the Update button.
  14. The results of the configuration will then be displayed as depicted by Figure 58.

    5-FINAL

    Figure 58 : Results of the configuration

    Note:

    If you have configured a policy to Include a few/all events (sources/IDs/descriptions/users), and Exclude none, then, while reconfiguring that policy, you will find that the Include option is chosen by default from the corresponding drop-down list in Figure 58. On the other hand, if you have configured a policy to Exclude a few specific events and Include all events, then, while modifying that policy, you will find the Exclude option being the default selection in the corresponding drop-down list in Figure 56.