Noise reduction rule clarification

	Forums Register Login My Profile Inbox Address Book My Subscription My Forums Member List Search FAQ Ticket List Log Out

Noise reduction rule clarification

Logged in as: Guest

Users viewing this topic: none

Printable Version

All Forums >> [Networking & Security] >> GFI EventsManager >> Noise reduction rule clarification

Page: [1]

Message

<< Older Topic Newer Topic >>

Noise reduction rule clarification - 24.Apr.2007 12:45:36 PM

Zergster

Posts: 27
Score: 0
Joined: 4.Mar.2007
Status: offline

Hi,

I am trying to determine if noise reduction rules are preventing events I want to see from being logged.

In particular, Noise Reduction -> Over-logging noise -> Ignore account logon events. The Actions tab says 'use default classification rules' and the General tab says Classify the event as 'Noise.' Does this mean it will get added to the database, but just with noise classification?

This KB article makes noise reduction rules sound like events get totally ignored:
http://kbase.gfi.com/showarticle.asp?id=KBID002859

Please clarify. Thanks.

Post #: 1

RE: Noise reduction rule clarification - 24.Apr.2007 1:06:59 PM

Arielle

Posts: 294
Score: 0
Joined: 15.Sep.2006
Status: offline

Hi Zergster,

By default events classified as noise are ignore, i.e. not saved in the database.

You can configure EventsManager to save events that are classified as noise by going to Configuration > Options and selecting 'Default Classification Actions'.

Alternatively, if you only want certain noise events to be saved in the database, open the rule properties and on the 'Actions' tab select 'Use the following actions profile'.

_____________________________

Arielle Bonnici - Quality Metrics Analyst
GFI Software - www.gfi.com

(in reply to Zergster)

Post #: 2

RE: Noise reduction rule clarification - 24.Apr.2007 2:28:13 PM

Zergster

Posts: 27
Score: 0
Joined: 4.Mar.2007
Status: offline

Thanks, I think I had seen this before, but I had forgotten.

(in reply to Arielle)

Post #: 3