Skip to main content
A newer release of this product is available.

event filter show

Contributors
Suggest changes
PDFs

Display the list of existing event filters.

Availability: This command is available to cluster administrators at the admin privilege level.

Description

The event filter show command displays all the event filters which are configured. An event filter is used to select the events of interest and is made up of one or more rules, each of which contains the following three fields:

*

  • name - event (message) name.

  • severity - event severity.

  • snmp-trap-type - event SNMP trap type.

     These fields are evaluated for a match using a logical "AND" operation: name AND severity AND SNMP trap type. Within a field, the specified values are evaluated with an implicit logical "OR" operation. So, if `-snmp-trap-type```_Standard, Built-in_`` is specified, then the event must match ``_Standard_`` OR ``_Built-in_`` . The wildcard matches all values for the field.
* Type - include or exclude. When an event matches an include rule, it will be included into the filter, whereas it will be excluded from the filter if it matches an exclude rule.

Rules are checked in the order they are listed for a filter, until a match is found. There is an implicit rule at the end that matches every event to be excluded. For more information, see event filter rule command.

There are three system-defined event filters provided for your use:

  • default-trap-events - This filter matches all ALERT and EMERGENCY events. It also matches all Standard, Built-in SNMP trap type events.

  • important-events - This filter matches all ALERT and EMERGENCY events.

  • no-info-debug-events - This filter matches all non-INFO and non-DEBUG messages (EMERGENCY, ALERT, ERROR and NOTICE).

The system-defined event filters cannot be modified or deleted.

Parameters

{ [-fields <fieldname>,…​]

If you specify the -fields <fieldname>, …​ parameter, the command output also includes the specified field or fields. You can use '-fields ?' to display the fields to specify.

| [-instance ] }

If you specify the -instance parameter, the command displays detailed information about all fields.

[-filter-name <text>] - Filter Name

Selects the event filters that match this parameter value.

[-position <integer>] - Rule Position

Selects the event filters that match this parameter value.

[-type {include|exclude}] - Rule Type

Selects the event filters that match this parameter value. The rule types are as follows:

  • include - Events matching this rule are included in the specified filter.

  • exclude - Events matching this rule are excluded in the specified filter.

[-message-name <text>] - Message Name

Selects the event filters that match this parameter value.

[-severity <text>,…​] - Severity

Selects the events that match this parameter value. Severity levels:

  • EMERGENCY - Disruption.

  • ALERT - Single point of failure.

  • ERROR - Degradation.

  • NOTICE - Information.

  • INFORMATIONAL - Information.

  • DEBUG - Debug information.

  • * - Includes all severities.

[-snmp-trap-type <text>,…​] - SNMP Trap Type

Selects the event filters that match this parameter value. The SNMP trap types are as follows:

  • Standard - Traps defined in RFCs.

  • Built-in - Enterprise traps specific to events.

  • Severity-based - Traps specific to events that do not belong to the above two types.

  • * - Includes all SNMP trap types.

Examples

The following example displays the event filters:

cluster1::> event filter show
Filter Name Rule     Rule      Message Name           SNMP Trap Type  Severity
            Position Type
----------- -------- --------- ---------------------- --------------- --------
default-trap-events
            1        include   *                      *               EMERGENCY, ALERT
            2        include   *                      Standard, Built-in
                                                                      *
            3        exclude   *                      *               *
important-events
            1        include   *                      *               EMERGENCY, ALERT
            2        exclude   *                      *               *
no-info-debug-events
            1        include   *                      *               EMERGENCY, ALERT, ERROR, NOTICE
            2        exclude   *                      *               *
7 entries were displayed.

The following example displays the event filters queried on the SNMP trap type value "Standard":

cluster1::> event filter show -snmp-trap-type Standard
Filter Name Rule     Rule      Message Name           SNMP Trap Type  Severity
            Position Type
----------- -------- --------- ---------------------- --------------- --------
default-trap-events
            2        include   *                      Standard, Built-in
                                                                      *

The following example displays the event filters with one or more rules that have no condition on the SNMP trap type. Note that the wildcard character has to be specified in double-quotes. Without double-quotes, output would be the same as not querying on the field.

cluster1::> event filter show -snmp-trap-type "*"
Filter Name Rule     Rule      Message Name           SNMP Trap Type  Severity
            Position Type
----------- -------- --------- ---------------------- --------------- --------
default-trap-events
            1        include   *                      *               EMERGENCY, ALERT
            3        exclude   *                      *               *
important-events
            1        include   *                      *               EMERGENCY, ALERT
            2        exclude   *                      *               *
no-info-debug-events
            1        include   *                      *               EMERGENCY, ALERT, ERROR, NOTICE
            2        exclude   *                      *               *
6 entries were displayed.