Assigning Classification Tags to a Normalization Rule

With this procedure, you can manage the Classification Tags assigned to a Normalization Rule (see How does Classification work?). If the Rules Engine - Display Classification Condition setting is enabled in your Manager's properties (see Changing a Manager's Advanced Settings), you can also define a regular-expression condition for the Tags assigned to user-defined Normalization Rules. If the rule has a condition, then TLC only associates the rule's Tags with a 'raw' log message if the message satisfies the criteria specified by the condition's regular expression.

To work with the Classification Tags assigned to a Normalization Rule:

1. In the side bar, select Resources >Configuration ManagerConfiguration Manager.
2. In the side bar of the Configuration Manager, select NormalizationNormalization >Normalization RulesRules.

TLC presents your Normalization-Rule Groups in the workspace table.

Tip

You can sort, group, and filter the contents of tables. For more information, see Working with Tables).

3. Under Normalization Rules, select the group containing the Normalization Rule.
4. In the workspace, double-click the rule.
5. In the Normalization Rule properties dialog, select the Classification tab.
6. To add a Classification Tag to the rule:
a. ClickClassification TagsAdd.
b. From the Tag Set drop-down for the new table row, select the Tag Set containing the Tag to be added.
c. From the Tag drop-down, select the Tag.

To remove a Classification Tag from the rule, select the Tag's line and clickDelete/RemoveRemove.

7. If you do not want to add any Classification Conditions for the assigned Tag(s), select None from the Classification Condition drop-down.

To add a Classification Condition:

a. From the Classification Condition drop-down, select Regular Expression.
b. In the field below the drop-down, enter the regular expression.

To test a Classification Condition defined by a regular expression:

a. Click Test.
b. In the Test Classification Condition dialog, enter the content of an applicable log message in the Enter the text of an applicable log message for this rule field and click Test.

The Output field indicates if the log message passed or failed the condition.

Tip

If you search the Audit Logger for 'raw' log messages (see Querying the Audit Logger for 'Raw' Log Messages), you can then copy the content of a message from the search results to the Enter the text of an applicable log message for this rule field.