Customize Event with Condition Rule to exclude events from IP x.x.x.x

Document ID : KB000046028
Last Modified Date : 14/02/2018
Show Technical Document Details

Introduction: 

Create an Event Condition to exclude alarms from a particular IP Address

Question: 

I only want an alarm to be displayed if this event comes from a device that does NOT have IP address x.x.x.x

Environment:  

Platform Independent

Answer: 

An Event Condition can be created to generate an event which does not assert an alarm when coming from a particular IP Address. A Second event generated by other IP Addresses will still assert alarms.

Example:

If event 0xxxxx occurs, if (regexp({a 0x12d7f} {A 1.1.1.2}))  evaluates to TRUE, then generate event 0xyyyyy. else (default) evaluates to TRUE, then generate event 0xzzzzzzz.

 

Where 0x12d7f is Attribute ID of Network Address.

If it matches IP Address 1.1.1.2, it will generate event 0xyyyyyyy (Set this event to not generate alarm. If you wish, not store events in historical database). Otherwise, it will generate event 0xzzzzzzz (which will generate the alarm for other devices).

Screenshot examples:

event_condition1.png

event_condition2.png

 

event_condition3.png

 

event_condition4.png

 

Additional Information:

https://communities.ca.com/message/241871511?commentID=241871511#comment-241871511