Alarm Management negate Rules

[Markus M.]

Hi,

I am trying to find a solution for the following:
The predifined ruleset "Bad Hyper-V username logon attempt" triggers occassionally unwanted alarms.
These alarms received are acceptable, but they don't follow a fixed schedule, so I can't suppress based on this parameter.
But they all have the same content in the Account Name field. So if I could set a rule defintion in negated manner, i.e. Event 4625 but not with Event text *<Accountname to suppress>* it would be fine.
Didn't find such option, so maybe any of you know a nice workaround for this?

Thanks!
Markus

[RomanK]

Hello Markus,

For alarms only ‘*’ (asterisk) and ‘?’ (question mark) wildcards are applicable. The ‘*’ (asterisk) character represents zero or more characters. The ‘?’ (question mark) stands for a single character. It is a bit strange, but if the account name you want to ignore has a unique length I think you may try to play with question marks.

Anyway, I'll double-check with devs if there is a chance to add negation somehow.

Thanks

[Markus M.]

Hi Roman,

The standard rule per se is fine, I discovered an unwanted login attempt with it few weeks ago - in this case the "*" in alarm text was correct to identify the account name.
For my understanding, with a "not" option in ruleset together with the "?" option, it would be easy to configure excludes for these (few) unwanted cases.
Lets see what devs think about it.

Thanks

[RomanK]

Hello Markus,

Unfortunately, developers confirmed that there is no negation at the moment.
It sounds like a feature for future releases.

Thanks

[Markus M.]

Ok,

glad to see it on feature request list and finding it in one of the next update release notes

Thanks!

[kirderf]

Hi,

I think that negation is a sorely needed feature to create more advanced alarm rules. So, I'm also very happy to see that it is on your feature request list.
Looking forward to having it available!

[kirderf]

Hi,

I would like to add a feature request for more Boolean operators in the Event Text field for Event type Alarm Rules. Currently we have the option to use the two wildcard operators '*' and '?' which works great, but that is a bit limiting. At least we should get a negating operator, that would greatly expand the possibility to fine tune the rules. I know that I can use AND and OR by creating two or more separate rules, but I believe that also adding these as operators to the Event Text field would in many cases add to the readability of more complex rules. For AND and OR to make sense, we obviously also need some sort of grouping operators.

Hope you can add this as a feature request. Crossing my fingers that we get to see negate, AND and OR in a future release of Veeam ONE, at least the negate operator!

[RomanK]

Hello Fredrik,

I merged your post into the existing request about event text operators.
The request is interesting and useful but I still cannot promise any ETA.

Thanks