Filtering events

Event filtering information is stored in the eventfilter file. This file instructs SCAuto when to block incoming events. If an event is not blocked, filters also can prevent opening incident records based on recurrence intervals and counts, and on incident intervals.

The number of filters available for external blocking is unlimited. The external process (SCAuto) reads the eventfilter file to select records with the same Event Code and User Name (or User Name=NULL) and with Block Events?=true until it finds one that satisfies the criteria for the event being processed. If none is found, the event is inserted in the eventin file.

Once records are added to the eventin file, Event Services assumes the filtering task using Internal Filters. Event Services first selects the filter with the same Event Code as that of the event being processed and with a Network Name of SCAuto. This filter must contain all internal blocking conditions. If an eventin record satisfies one of the Block Conditions, it is updated to reflect a Status of blocked. The event action (for example, incident open or inventory add) does not take place.

With incident open event types (pmo), the Additional incident Filters take effect if no blocking condition exists. This filtering mechanism is available only when opening new incidents.