Assigning Classification Tags to a Normalization Rule
With this procedure, you can manage the Tags assigned to a (see How does Classification work?). If the Rules Engine - Display Classification Condition setting is enabled in your Manager's properties (see Changing a Manager's Advanced Settings), you can also define a regular-expression condition for the Tags assigned to user-defined Rules. If the rule has a condition, then TLC only associates the rule's Tags with a 'raw' if the message satisfies the criteria specified by the condition's regular expression.
To work with the Classification Tags assigned to a Normalization Rule:
|
1.
|
In the side bar, select Resources >. |
|
2.
|
In the side bar of the Configuration Manager, select Normalization >Rules. |
TLC presents your Normalization-Rule Groups in the workspace table.
Tip
|
You can sort, group, and filter the contents of tables. For more information, see Working with Tables).
|
|
3.
|
Under Normalization Rules, select the group containing the Normalization Rule. |
|
4.
|
In the workspace, double-click the rule. |
|
5.
|
In the Normalization Rule properties dialog, select the Classification tab. |
|
a.
|
ClickAdd. |
|
b.
|
From the Tag Set drop-down for the new table row, select the Tag Set containing the Tag to be added. |
|
c.
|
From the Tag drop-down, select the Tag. |
To remove a Classification Tag from the rule, select the Tag's line and clickRemove.
|
7.
|
If you do not want to add any Classification Conditions for the assigned Tag(s), select None from the Classification Condition drop-down. |
To add a Classification Condition:
|
a.
|
From the Classification Condition drop-down, select Regular Expression. |
|
b.
|
In the field below the drop-down, enter the regular expression. |
To test a Classification Condition defined by a regular expression:
|
b.
|
In the Test Classification Condition dialog, enter the content of an applicable log message in the Enter the text of an applicable log message for this rule field and click Test. |
The Output field indicates if the log message passed or failed the condition.
Tip
|
If you search the Audit Logger for 'raw' log messages (see Querying the Audit Logger for 'Raw' Log Messages), you can then copy the content of a message from the search results to the Enter the text of an applicable log message for this rule field.
|