Hi,
We're building some correlation rules for our system, and were wondering what the impact is of ordering multiple filters.
For example, we'd like to get all Critical alarms for a specific Protocol - we're thinking to filter by protocol first, then filter by severity.
Does this ordering matter, and how impactful would it be? Based on the answer, we might go back and redo some existing correlation rules to be more efficient.
Thanks!
Hi Sheikh,
When you have multiple filters, it might be better to start with more specific filters.
For example, if you start with severity, you will have to search the severity of all protocols; but starting with a protocol would mean you already narrow down to that protocol. Ordering does not matter but doing this might be efficient.
Based on your requirement, starting with more narrow/specific filters would be preferable.
Hi,
for reference: Adding alarm filters to Correlation rules | DataMiner Docs
DataMiner Advanced - DMS correlation
I hope it helps.