Customer area
Your tools are great. Simple, clean, useful,...
Loading...
HOW TO: Setup Script-based Complex Filters

Currently, Kiwi Syslog Daemon's complex filters only allow for filter expressions of the form:

(A OR B) AND (C OR D)

The following script illustrates how to perform complex filtering, based on any valid logic (boolean) expression. Specifically, the example script provided, demonstrates how to create a (script-based) complex filter of the form:

A AND B AND (C OR D OR E OR F)

Please note, that this script can be very easily modified, to provide complex filtering for any valid logic expression.

eg.

  • ((A OR B) AND (C AND D)) AND (E OR F)
  • (A AND (NOT (B OR C)))
  • (A AND B AND (C OR D) AND (E OR F) AND (NOT (G OR H)))
  • etc...

Function Main()
	'=============================================================================
	' Kiwi Syslog Daemon
	' Complex Script-based Filtering Example
	'-----------------------------------------------------------------------------
	' Currently, Kiwi Syslog Daemon's complex filter function
	' only allows for complex filters of the form:
	'
	' (A or B) AND (C or D)
	'
	' This script illustrates how to perform complex filtering, for any valid 
	' boolean expression.  For example, this script demonstrates how to create
	' a complex substring filter of the form:
	'
	' A AND B AND (C OR D OR E OR F)
	'
	' Note: That this script can easily be extended to provide filtering for
	'       any of the following complex filter expressions.
	'
	' ((A OR B) AND (C AND D)) AND (E OR F)
	' (A AND (NOT (B OR C)))
	' (A AND B AND (C OR D) AND (E OR F) AND (NOT (G OR H)))
	' etc...
	' etc...
	'
	' Basically, Any valid logic expression that evaluates to either TRUE or FALSE
	' (no matter how complex)
	'============================================================================
	'=================================================================
	' Include as many logic parameters as you need for your expression
	'=================================================================
	Dim A
	Dim B
	Dim C
	Dim D
	Dim E
	Dim F
	Dim G
	Dim H
	Dim I
	Dim J
	Dim K
	' This holds the filter result
	'=============================
	Dim FilterResult
	' This holds the text to be filtered
	'====================================
	Dim FilterText
	'==============================================
	' First, Set the text we're going to filter
	' In our case, it'll be the Syslog Message-text
	'==============================================
	FilterText = Fields.VarCleanMessageText
	' Set the parameters of our test
	'===============================
	' Note: The function Instr(), returns a value greater than
	'	zero when the search-text is found in FilterText.
	' eg.	Instr(FilterText,"All") returns >0 when the text "All"
	'	has been found in "FilterText"
	'	So, The final expression of (Instr(FilterText,"All")>0) returns
	'       TRUE or FALSE.  TRUE if "All" was found in "FilterText" or
	'	FALSE if it wasn't found.
	'
	A = (Instr(FilterText,"All")>0)
	B = (Instr(FilterText,"Your")>0)
	C = (Instr(FilterText,"Base")>0)
	D = (Instr(FilterText,"Are")>0)
	E = (Instr(FilterText,"Belong")>0)
	F = (Instr(FilterText,"To Us")>0)
	'==========================================================
	' Evaluate our expression, store the result in FilterResult
	'==========================================================
	FilterResult = A AND B AND (C OR D OR E OR F)
	'====================================================================================
	' Take action on the result of the filtering
	'====================================================================================
	' Note:	In this example, if our filter returns TRUE we will continue to process the
	'	syslog message as normal.
	'	If, on the other hand, it returns FALSE, we will need to stop the message
	'	from being processed any further.  To do this we call .ActionQuit with a
	'	value of 100 (Skip to next rule).  This will stop the current rule processing
	'	the message any further, and pass execution to any following rule.
	If FilterResult = False Then
		'Filter has failed, so Skip to the next rule... 
		Fields.ActionQuit = 100
	End If
	' Set the return value to indicate that the script ran correctly
	Main = "OK"
End Function

To use this script, add it (as a Run-Script Action) to any active Rule in Kiwi Syslog Daemon Setup.

Any Actions that you have added after this script-based filter, will only execute if the filter expression returns TRUE.

0 votes so far for this article. Did this article help you? YES NO