Guidelines for Creating a Payload Filter

Note: This topic is used in multiple places and is specifically not added to the TOC.

When creating a Payload Filter, note the following:

• Payload  Filter expressions for the like and not like operators use the syntax defined for Java regular expressions (java.util.regex Pattern class)
• You must use a ciaName that already exists in the trap or event you are configuring.
• Each set of expressions associated with a Boolean Operator is treated as if it were enclosed in parentheses and evaluated together.
• View the expression displayed under Filter String to see the logic of the expression as it is created.

• The AND and OR Boolean Operators must contain at least two expressions as shown in the example below.

  The following example filters incidents on voltage state (CISCO-ENVMON-MIB MIB, ciscoEnvMonVoltageState). Using this Payload Filter, you could then configure the Basics settings of the Enrichment configuration to set the severity and message format to all incidents that return a state value of 4 or 5.

  OR
    AND
      ciaName = .1.3.6.1.4.1.9.9.13.1.2.1.7
      ciaValue = 4
    AND
      ciaName = .1.3.6.1.4.1.9.9.13.1.2.1.7
      ciaValue = 5

  NNMi evaluates the expression above as follows:

  ((ciaName = .1.3.6.1.4.1.9.9.13.1.2.1.7 AND ciaValue = 4) OR (ciaName = .1.3.6.1.4.1.9.9.13.1.2.1.7 AND ciaValue = 5))

  NNMi finds all incidents with a varbind of .1.3.6.1.4.1.9.9.13.1.2.1.7 and a CIA value of 4 or 5.

  Note When you use ciaName and ciaValue in a Payload Filter, you must enter the ciaName and ciaValue as a pair as shown in the preceding example.

• The placement of your cursor and the subsequent text that is selected is important when performing operations using the Payload Filter Editor. For example, you append to, replace, or change the indentation of the expression that is selected.
• The placement of your cursor and the subsequent text that is selected is especially important when adding your Boolean operators.