Create MPE Policies

You must be logged in as an Administrator to take this action.

1. On the main toolbar, click Deployment Manager.
2. Select the Log Processing Policies tab.
3. Click the New icon on the toolbar.
   The Log Source Type Selector window appears.
4. Select a Record Type Filter.
5. In the Log Source Type list, select a Log Source Type.
6. Click OK.
   The MPE Policy Editor window appears.
7. Enter a policy name.
8. (Optional) Enter a description.
9. Enable the selected rules:
   1. Select the box in the Edit column of each rule you want to enable.
   2. Right-click and select Properties from the context menu.
   3. Enter the appropriate information in the MPE Policy Rule Editor:
      1. Check Enabled to allow further selections in this window.
      2. Check Override Log Source Management Settings to allow selection from the list.
         • Don't Archive. Do not write a copy of the logs to archives.
         • Drop Whole Log. Log messages are not indexed.
         • Drop Raw Log. Only log meta-data are indexed.
      3. (Optional) Under Log Processing Settings, select Disable Automatic Host Contextualization (AHC).
      4. Under Platform Manager Settings:
         • Select Log should be forwarded as event.
         • Select the Risk Rating and /or the False Alarm Rating for the forwarded logs.

      5. Under LogMart Settings, select the Override Log Source LogMart setting check box.

         

         Global Log Processing Rule Manager can override sending logs to LogMart.

      6. (Optional), click Advanced to display the LogMart Record Fields window where you can specify fields to store in the LogMart record.
10. Click OK when you are finished.
    You return to the MPE Policy Rule Editor window.
11. (Optional) Enable Allow Automatic MPE Rule Sorting.
12. Click OK.
    The new policy appears in the list, ready for assignment to a log source.