Web Tap Documentation

PREVIOUS - 2.6 Groups     UP - 2. The Management Interface

2.7 Filters

Filters provide the ability to automatically group or change the status of alerts based on their server, client, or type. The filters page will list all of the filters that are currently active and allow you to modify or add new filters. Filters are applied in the order that they appear. This means that if an alert matches more than one filter and the actions conflict (i.e. set read, priority, or status to different values or move to different groups), then the action specified in the later alert (top to bottom) will take precedence.

Changes you make to a filter can be saved using the “Save” button under the “Action” column. The “Delete” button will permanently remove the filter. It is only possible to edit one filter and save changes at a time. If the “Apply” box is checked when you save a filter, Web Tap will also apply the actions to all current alerts that match the filter criteria, including adding or moving the alerts to a group if specified. The “Test” button will display all of the current alerts that match the filter criteria.

2.7.1 Matching Criteria

In the “Server(s)” and “Client(s)” columns, Web Tap supports matching strings in one of the following formats:

• Exact IP Address – “192.168.1.1” – This will match an exact client or server IP address.
• IP Range – “192.168.1.10-192.168.1.20” – This will match a range of server or client IP addresses, including both the start of the range and end of the range.
• IP Mask – “192.x.x.x” – “192.168.x.x” – “192.168.1.x” – This will match IP addresses of servers or clients with the first one, two, or three octets fixed and the other octets as variable. The matching string “192.168.1.x” is equivalent to “192.168.1.0-192.168.1.255”.
• Exact Hostname – “www.google.com” – This will match an exact client or server name. Note: sometimes an exact hostname may match a number of IP addresses if a server farm is handling request for that hostname.
• Domain – “*.google.com” – This will match any hostnames that end in whatever is to the right of “*.”, including a hostname that is just the right of the matching string (i.e. google.com). So, a matching string “*.a.b.c” would match the following hostnames: “x.a.b.c”, “x.y.z.a.b.c”, and “a.b.c”, but not the hostname “b.c” or “x.b.c”. Web Tap will not match hostnames in the in-addr.arpa domain.

2.7.2 Filter Actions

The Alert Type column allows you to filter alerts based on their type. When Web Tap generates a new alert, or a new entry for an old alert, it will only match filters that have the same alert type or match any alert type.

The “Set Read”, “Set Priority”, and “Set Status” columns allow you change the status of new alerts or new entries for old alerts. Note: When filters affect new entries for old alerts, they may not change the entire alert’s status as expected. The following are conditions decide the entire alert’s status:

• Viewed – All entries for the alert must be marked as viewed, otherwise the alert will show up as new.
• Priority – The entire alert will show the priority of the highest-priority entry.
• Status – If any entries are pending, then the alert will be pending. If all entries are marked as fixed, then the alert will be fixed. If there are some ignored entries and some fixed entries, then the alert will show up as ignored.

The “Set Group” column of the filter will add new alerts to a specified group. If the “Move” box is checked, then the alert will also be removed from the main group and any other groups of which it is a member. Note: “Add to Group” will not affect new entries for old alerts; their group membership status will remain unchanged.

PREVIOUS - 2.6 Groups     UP - 2. The Management Interface