OpenAccess SDK Events : Filtering Events

Filtering Events

You can place a filter on the attributes of any event. For example, if you want to monitor and trace only sessions that are started by users, not administrators, you would write the following filter for the Session Started event:

${Authorization} = "user"

The syntax for a filter placed on an event is:

[not] [(]${event_attribute} comparison_operatorfilter_value[)] [boolean_operator (${event_attribute} comparison_operatorfilter_value)...]

where:

comparison_operator is one of the following comparison operators:

=	>	equals	bigger	nsmaller
!=	<=	nequals	nbigger
<	>=	contains	smaller

You can use the symbols or the words; they are equivalent (for example, using != is the same as using nequals).

filter_value is the value for the attribute. The value can be a string or an integer, depending on the attribute type. Strings must be quoted.

boolean_operator is one of the following operators: and, nand, or, nor, xor, nxor

For example:

[not] (${ServiceUser} equals "oauser")
(${ClientInfo} contains "196.72") and (${RowsFetched} > 1000)
(${Statement} contains "insert") and (${ReturnCode} != 0)
(${Statement} contains "insert" and (${ReturnCode} = -1 or ${ReturnCode} = -2)
${timestamp} > "2007-06-26 02:00:00"

Notes

Strings must be quoted.

The comparison operator "contains" can only be used in combination with string constants.

Filtering using Timestamps is done by comparing ${TimeStamp} with strings in ISO 8601 time format : "YYYY-MM-DD [hh:mm:ss]".