Filter criteria for Log Monitor data collection

Set the filter criteria for data collection using the Log Monitor Policies form. The filter criteria you set on that form determines what data the Log Monitor Service actually collects.

Once you set the filter criteria on the Log Monitor Policies form, the Log Monitor Service collects only the specified data. This means, for example, that, if you have set the data collection policies to exclude SQL type data, no SQL data is collected; and therefore, even if you tell the Log Monitor form to display SQL data, no data is displayed (because there no SQL data in the log).

To again collect--and therefore, be able to display--SQL data on the Log Monitor form, you must again change the data collection settings on the Log Monitor Policies form.

Site coordinators can also use the Log Monitor Policies form to add multiple filter policy sequences and override filter policies written in the configuration file, at runtime. If you run the Log Monitor Policies form in a configuration other than the Site Coordinator Configuration, then the Sequence field and the Active check box are read-only. The Sequence field is used to specify the sequence number of a filter policy. The Active check box is used to activate or deactivate a filter policy. To modify these settings, you must use the Log Monitor Policies form in the Site Coordinator Configuration.

Categories for data collection

On the Log Monitor Policies form, you can set any combination of these categories of data:

Source - To allow data to be collected from all sources, leave this field blank.
To limit the display to data from a single source, specify the name of the source; for example: IDORuntime
To allow data to be displayed from multiple sources, specify the sources as a pipe-delimited list; for example: IDORuntime | MGEvent
Type - To select a data type for collection, select its check box. To exclude a data type from collection, clear its check box.
Text - To allow all message text to be collected, leave this field blank.
To limit the amount of text that is collected, based on its content, type the text to include in this field. To allow for multiple text strings, specify them as pipe-delimited lists. For example, you might include a list like this: Querying suspending insert event initiators | Session ID:
You can use wild cards in this field, in the form of either Regular Expressions or plain text. However, you cannot mix the two; it must be one or the other. Also, you cannot use standard Mongoose wild cards, such as the asterisk (*), because the system treats it as plain text. It is also true that the asterisk is treated differently in RegEx syntax.
If you are using Regular Expression (RegEx) text, you can use special characters, but you should exercise caution here and make sure to input correct RegEx syntax.
If you are using plain text, and you were to input something like 'Sample', the system treats it as "*Sample*", automatically wrapping the text with asterisks.

Note: When filtering data to be recorded, the system filters by a combination of all three categories. Incoming data records must satisfy the criteria of all three filters before it is recorded in the log. For example, if you were to set the Source to IDORuntime, the Type to SQL|Audit, and the Text to IsSaasSession, only those data records that meet all three of these restrictions are written to the log.