Filtering Events

You can place a filter on the attributes of any event. For example, if you want to monitor and trace only sessions that are started by users, not administrators, you would write the following filter for the Session Started event:

${Authorization} = "user" 

The syntax for a filter placed on an event is:

[not] [(]${event_attribute} comparison_operator filter_value[)] [boolean_operator (${event_attribute} comparison_operator filter_value)...]

where:

comparison_operator is one of the following comparison operators:

=	>	equals	bigger	nsmaller
!=	<=	nequals	nbigger
<	>=	contains	smaller

You can use the symbols or the words; they are equivalent (for example, using != is the same as using nequals).

filter_value is the value for the attribute. The value can be a string or an integer, depending on the attribute type (see Table E-2). Strings must be quoted.

boolean_operator is one of the following operators: and, nand, or, nor, xor, nxor

For example:

[not] (${ServiceUser} equals "sluser") 
(${ClientInfo} contains "196.72") and (${RowsFetched} > 
1000) 
(${Statement} contains "insert") and (${ReturnCode} != 0) 
(${Statement} contains "insert" and (${ReturnCode} = -1 or 
${ReturnCode} = -2) 

NOTE: Strings must be quoted, and the comparison operator "contains" can only be used in combination with string constants.