When you change the rules file, add new rules, or create
lookup tables, it is useful to test the probe by running it in debug
mode. Debug mode shows how an event is being parsed by the probe and
can uncover any problems with the rules file.
About this task
You can enable debug mode from the command-line interface
or by changing the probe properties file. If you need to change the
message level of a running probe without stopping the probe, you can
use the kill command against the probe process
ID (PID).
Procedure
What to do next
For changes to the rules file to take effect, force the probe
to reread the rules file.