Overview

This article provides a workaround on how to avoid archiving unnecessary events.

Process

In event activity processing and monitoring, noise refers to unwanted or repeated events.

Event activity monitoring is a continuous process. Computer systems tend to generate millions of events - most of which are noise/repeated events. It makes more difficult to monitor events that are really important and besides, it will fill the database with useless information.

Creating the Custom Noise Rule

1. In the GFI EventsManagement Console, click on the Configuration button and select Event Processing Rules.
2. Expand the node 'Noise Reduction'.
3. Click on the 'Create new rule set' link in the Common Tasks section and give it a name (e.g. 'Event XXX').
4. To create the new rule, click on the 'Create new rule' link.
5. Specify a name for the new rule such as 'noise caused by YYY' and enter a brief description. Click on the Next button to proceed. 
6. Select which type of event log(s) will apply to this rule. Expand the Original option if you want more details. Click on the Next button to continue.
7. Enter what type of filtering conditions are applied for this rule. Event ID XXX will be entered.
8. You have an option to set ID, Source, Category, User and Event Type.
9. If you wish to perform advanced filters, click on Advanced button and enter any additional filters by clicking on the Add button.
10. Click on Next to proceed through the wizard.
11. Define the occurrence (default: 'any time of the day').
12. Classify the event as 'Noise Event'. Click Next.
13. As the actions that will be taken, select 'Ignore the event' and click Next.
14. Click Finish to create the rule.