CS-MARS: linking custom events to existing event-groups

Answered Question
Jul 23rd, 2007
User Badges:

Hi,


i've created a custom event in the course of working with custom parsers (which works fine in most cases).


i would like to add this custom event to an existing event-group. this would be important because every time the custom event occurs the existing rules (were the event-group is used) would be fired and an incident would be created.

if the custom event won't be added to existing event-groups, i'll never get an incident because no rule will match (no existing

rule uses my new event).


is there a possibility to add my custom event to an existing group??


many thanks i've you have an idea to solve my request.


kind regards,


bernhard

Correct Answer by mhellman about 9 years 9 months ago

Sorry, you cannot modify the event groups. That is why it is so important when creating parsers to use existing events whenever possible. If there is an existing event that even comes close to meaning the same thing, you might be better off using it. Otherwise, you must create a custom inspection rule to deal with the custom event.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
Loading.
Correct Answer
mhellman Mon, 07/23/2007 - 06:28
User Badges:
  • Blue, 1500 points or more

Sorry, you cannot modify the event groups. That is why it is so important when creating parsers to use existing events whenever possible. If there is an existing event that even comes close to meaning the same thing, you might be better off using it. Otherwise, you must create a custom inspection rule to deal with the custom event.

mogli Mon, 07/23/2007 - 07:38
User Badges:

thanks a lot for your answer!! maybe that's something for a feature-request?!?!? :-))


the reason i would like to have this feature is because i like to set in some cases other severities to the events than the predefined one's.


sure, i could use any other predefined event (which points to a nearly similar topic) with the recommended severity. but i would get an event with a description which doesn't match to that what really happened...


in my opinion an very unattractive workaround (in this case there is at least a work around ;-)..


best regards,

bernhard

Actions

This Discussion