Does event filter block exclude event when include rule placed at first?
Applies to
ONTAP 9
Answer
- Yes, event filter block event specified in exclude event when include rule placed at first and those include rule event don't duplicate with exclude rule event.
- For example, in the following scenario
security.invalid.loginevent specified in the second exclude rule can be blocked.
::> event filter show
Filter Rule Rule SNMP Trap
Name Posn Type Message Name Severity Type Parameters
----------- ---- -------- ---------------- ------------- --------- -----------
default-trap-events
1 include smc.snapmir.schd.trans.overrun * * *=*
2 exclude security.invalid.login * * *=*
3 include * EMERGENCY, ALERT Standard, Built-in, Severity-based *=*
Additional Information
additionalInformation_text
