Global Monitoring Filters

<< Click to Display Table of Contents >>

Navigation:  Monitoring with EventSentry > ADMonitor > Utilities > ADMonitor Console >

Global Monitoring Filters

Global Monitoring Filters can be used to filter out certain changes to objects that do not need to be audited. Changes that are filtered through a global filter are still recorded in the local ADMonitor Cache, but will not show up in ADMonitor Viewer or web reports.

 

The table below lists the types of triggers and criteria that can be used to filter changes. Note that multiple conditions can be combined, for example an object change can be combined with an attribute change.

 

Trigger Options

Search What

Description

Search Operator

Object

Filter out general changes to objects, usually combined with additional conditions.

was created

was modified

was deleted

was created or modified

was created or deleted

was modified or deleted

Attribute

Filter out changes to attributes, such as attribute values or attribute names.

is equal

is not equal

contains

does not contain

BIT is set

BIT is not set

was created, modified or deleted

was created

was modified

was rewritten

was created or modified

was created or rewritten

was modified or rewritten

is found

is not found

Classname

Filter out changes based on the class name.

is equal

is not equal

contains

does not contain

Object-Name

Filter out changes based on the object name.

is equal

is not equal

contains

does not contain

Object-GUID

Filter out changes based on the object GUID.

is equal

is not equal

contains

does not contain

Who

Filter out changes based on who performed the change.

is equal

is not equal

contains

does not contain

Organizational Unit

Filter out changes based on the organizational unit where the change occurred.

contains

does not contain

 

Managing Filters

Global Monitoring Filter Settings

Existing filters are displayed in the "Global Monitoring Filter Settings" dialog (1 below), and are managed via the Add, Edit and Delete buttons. Adding or editing an existing filters brings up the Filter Trigger Settings dialog (2 below), which shows the trigger name, description and trigger list.

 

Filter Trigger Settings

Triggers themselves are listed under Trigger detail (2) and managed via the Edit, Insert and Delete buttons. Inserting or editing an existing trigger brings up the Trigger Line Details dialog (3) where the trigger is configured.

 

Trigger Line Details

The table above shows the possible trigger options supported, multiple items in the "Search For" list (4) are ORed.

 

clip0349

 

info_24

In most cases the Viewer utility can be used to test a filter and ensure it works as expected.