Compression Concept for MonitorWare Console System Status Report
Article created 2004-11-03 by Hamid Ali Raja.
Overview
This paper explains you the concept behind the compression rules those are employed in System Status Report of MonitorWare Console.
System Status Report - Compression Rules
Information in system status report appears against individual combinations of FromHost, Event Log Type, Event Source, Event ID and Message. Difference in one of the values of these attributes gives birth to a new row. We have a count attribute that specifies the number of times a specific combination occurred.
Sample System Status Report data without compression rule application
Figure 1
Figure 1 shows that there are N number of messages/rows for single user logoff information for same FromHost, Event Log Type, Event Source and Event ID values as each message has a different logon id. 1 under count attribute specifies that each combination (FromHost, Event Log Type, Event Source, Event ID and Message) has occurred once as on each logon, user was assigned a new logon id that was different from the previous ones.
Compression Rule Application
As explained above, since all of the messages have different logon ids, N different rows will be created in the System Status Report. If you want to compress these N messages to a single message, you can easily remove logon ids from these messages by passing it through the compression rule of System Status Report (as shown in figure 2). To achieve this, you just need to check the “Remove Logon ID from Event ID = 528, 538, 540” checkbox in Advanced Filters for System Status Report.
Figure 2
This compression rule will parse messages before displaying them in report and remove the logon id. In this case, implementation of this compression rule only displays one message in the report, as shown at the bottom of figure 2 & 3. Please note that this logon id information is only temporarily removed from the messages before displaying them in the report. The actual contents of the messages with all the information will remain unaltered in the data source.
Sample System Status Report data after compression rule application
Figure 3
Now we have only one message for user logoff information and count value specifies that this message occurred N times. In short compression rule has compressed N messages to just one message by removing logon id.
In the above discussion, I have only considered one compression rule to communicate the idea. There are many other compression rules that can be applied to generate a nice and concise report. To learn more about the compression rules, please click on the following link:
System Status Report Advanced Filters
|
