Event Processing Rules Window

Allows you to view, create, edit, and delete event processing rules in a processing rule group. The fields are defined as follows:

Name

Specifies the name of the rule.

Enabled

Specifies whether the rule is currently enabled.

Type

Specifies the event processing rule type, such as filter or forwarding.

Provider Name

Specifies the name identifying a particular instance of a provider that generates an event, such as Security for Windows Event Log.

Provider Type

Specifies the type of information provider that generates the event, such as Windows Event Log or WMI Events.

Source

Specifies the Windows event source that matches this rule, such as Microsoft Exchange Server or Microsoft SQL Server.

ID

Specifies the Windows event identification number that matches this rule.

Event Type

Specifies the event type, such as Error or Audit Failure.

Event Text Criteria

Specifies the text-pattern matching expression for event text for events matched by this rule.

Response

Specifies whether a rule match generates a response, and if so, what response.

To create an event processing rule, complete the following steps:

1. Select Event Processing Rules in the left pane.
2. Click Action on the menu bar.
3. Click New on the Action menu.
4. Click Event Processing Rule on the New Menu.

To edit a processing rule, complete the following steps:

1. Select a processing rule in the right pane.
2. Click Action on the menu bar.
3. Click Properties on the Action menu.

To delete a processing rule, complete the following steps:

1. Select a processing rule in the right pane.
2. Click Action on the menu bar.
3. Click Delete on the Action menu.