Submit a ticketCall us

Have You Auto Renewed? If not, you're missing out.
The SolarWinds Renewal Program comes with a host of benefits including the most recent product updates, 24/7 technical support, virtual instructor-led training and more. Experience all of this with the convenience of Auto Renewal, and never worry about missing any of these great benefits. Learn More.

Home > Success Center > Log & Event Manager (LEM) > LEM Administrator's Guide > Get started building custom rule expressions in LEM

Get started building custom rule expressions in LEM

Updated: September 15, 2017

This topic provides information to help you write custom rule expressions in LEM.

About custom rule expressions

Use caution when creating rules. SolarWinds recommends that you practice creating filters before you start creating rules. Creating rules is similar to creating filters, but filters report event occurrences whereas rules act on them.

Begin configuring rules when you are comfortable with configuring filters. Always test your rules before implementing them.

You can create rules by configuring conditions between alert variables and other components (such as time of day sets, user-defined groups, constants, and so on). Using rules, you can correlate alert variables with other alerts and their alert variables.

You can configure rules to fire after multiple alerts occur. LEM remembers alerts that meet the basic rule conditions and waits for additional conditions to be met. The rule does not execute until the alerts meet all of the conditions and correlations defined for the rule.

When you correlate alert variables, you specify how often and in what time frame the correlations must be met before the rule is triggered. The combined correlations dictate when the rule initiates an active response.

Last modified

Tags

Classifications

Public