Policy Log Filter
Filter causes the list of events to display only the records that match the filter settings. To view or change these settings, click Filter on the shortcut menu. The filter settings are displayed in the Filter dialog box that appears:
In the Filter dialog box, you can use the following settings to configure a filter:
•Include - List only the events that match these conditions. To set up and apply these conditions, select the Enable filter check box on the Include tab.
•Exclude - Remove the events from the list that match these conditions. To set up and apply these conditions, select the Enable filter check box on the Exclude tab.
Note: The mark next to the tab name turns green if the filter on that tab is enabled. Otherwise, the mark is gray. |
•Event types - Select check boxes to filter event records by type:
•Success - Task or operation completed successfully.
•Information - Certain action performed.
•Warning - A problem might occur unless action is taken.
•Error - A problem has occurred.
•String fields intended to include or exclude event records depending upon whether event data matches the filter string specified. For example, to filter records by the name of the computer that caused the event, specify a filter string in the Computer name field. To filter records with certain event IDs, enter ID numbers separated by a semicolon in the Event ID field.
The following string fields are available:
•Computer name - The name of the computer that caused this event.
•Policy Object - The name of the policy object associated with the event.
•Information - A description of the event that provides details on the actions performed and errors encountered.
•Server - The name of the computer running DeviceLock Enterprise Server that logged the event.
•Event ID - The ID number of the event.
Note: To assist with configuring a filter, string setting fields store previous entries and suggest matches for what is being typed. Previous entries are also available on the drop-down list of options for the setting field. |
•From, To - The time range settings to filter events by time they were logged by the server.
•Consolidation - The fields to filter by log consolidation-related data (see
Consolidating Logs):
•Server - The name of the remote server from which the event was last received during log consolidation. This field is case-insensitive, and allows the use of wildcards (* and ?). To enter multiple values, separate them with a semicolon (;).
•From, To - The time range settings to filter events by time they were last received from the remote server during log consolidation.
For each time range, the following settings are available:
•From - The beginning of the time range. Possible values:
•First Record - Filter starting with the earliest date and time in the respective log field.
•Records On - Filter starting with a particular date and time.
•To - The end of the time range. Possible values:
•Last Record - Filter ending with the latest date and time in the respective log field.
•Records On - Filter ending with a particular date and time.
When configuring a filter, consider the following:
•Filter conditions are combined by AND logic, that is, a given record matches the filter if it matches each of the filter conditions. Clear the fields that are not to be used in the filter conditions.
•Filter string fields may include wildcards, such as an asterisk (*) or a question mark (?). An asterisk represents zero or more characters; a question mark represents any single character.
•A filter string field may include multiple values separated by a semicolon (;). In this case, the values are combined by OR logic, that is, a given record matches the filter condition on a particular field if it matches at least one of the values specified in that field.
•The Clear button in the Filter dialog box provides the option to remove all the defined filter conditions and start setting up a new filter from scratch.
•The Save and Load buttons in the Filter dialog box are used to save the filter conditions to a file and to load previously saved filter conditions from a file.
