Configuring the Message Handler

The Message Handler has its own default configuration file which specifies the different data sources. The configuration file 00_src_default_rules.xml is stored in the <TRAVERSE_HOME>/etc/messages/ directory by default.

This <TRAVERSE_HOME>/etc/messages/ directory also contains the following subdirectories, which contain configuration files for the various data sources:

ism
logfile
snmp
syslog
winevent

Note: In order to preserve changes during upgrades, it is recommended that customizations to any of the Message Handler configuration files be made by copying the files to the <TRAVERSE_HOME>/plugin/messages directory and making the changes there.

You must restart the message handler after making any changes to this configuration file.

<message-handler>

 <!-- default rules -->

 <ruleset-defaults type="*">

  <action>ignore</action>

 </ruleset-defaults>

 <ruleset-defaults type="socket">

  <action>accept</action>

  <severity>ok</severity>

  <show-message>true</show-message>

  <auto-clear>300</auto-clear>

  <transform>${device_name}

    ${raw_message}</transform>

 </ruleset-defaults>

</message-handler>

The ruleset-default parameter is a default ruleset for pattern matching. See the table for the descriptions of each rule element.