Filtering events when systems fail

When an adapter is unable to connect to the event server , it sends the events to a file if the BufferEvents keyword is set to YES.

About this task

You can filter events sent to a cache file, similar to filtering events for the event server, by using the FilterCache keyword.

Note: To prevent the loss of data, the cache must be large enough to store all generated events in the event of an outage.

The following procedures describe how to filter events with the FilterCache and FilterMode keywords, when the event server is unavailable:

To cache specific events:
1. Set FilterMode to IN.
2. Set BufferEvents to YES (the default value).
3. Create Filter and FilterCache statements to match the specific events that you want cached.
To discard specific events:
1. Set FilterMode to OUT.
2. Create Filter and FilterCache statements to match the specific events that you want discarded.
To cache all events (the default behavior):
1. Set FilterMode to OUT.
2. Set BufferEvents to YES.
3. Do not specify any FilterCache statements.

Note: All events are discarded when the configuration is as follows: