Hi,
We’re building some correlation rules for our system, and were wondering what the impact is of ordering multiple filters.
For example, we’d like to get all Critical alarms for a specific Protocol – we’re thinking to filter by protocol first, then filter by severity.
Does this ordering matter, and how impactful would it be? Based on the answer, we might go back and redo some existing correlation rules to be more efficient.
Thanks!
Hi Sheikh,
When you have multiple filters, it might be better to start with more specific filters.
For example, if you start with severity, you will have to search the severity of all protocols; but starting with a protocol would mean you already narrow down to that protocol. Ordering does not matter but doing this might be efficient.
Based on your requirement, starting with more narrow/specific filters would be preferable.
The end result would be the same, but one filter might do more searching which could, for example, be intensive resource wise (CPU, speed etc).
Hi,
for reference: Adding alarm filters to Correlation rules | DataMiner Docs
DataMiner Advanced – DMS correlation
I hope it helps.
Thanks for the link!
Thanks for the reply. Just on 'Ordering does not matter but doing this might be efficient.', does this mean it doesn't matter for the returned resultset? I would assume the order of filters would always return the same data, just one order might be faster than the other.