View Settings
Maximum number of Events
•Specifies the maximum number of rows displayed in the Event View. You may select any value from 1 through 50000. The larger the number, the more memory the mmc.exe process will consume and the longer the query will take to return results.
Date Range
•The From Date and To Date fields specify a date range. By default the To Date range is Now . New events that meet the filter criteria can be added dynamically to this view as they are received. You may select one of the pre-selected choices from the drop-down, or enter your own date range.
Filters
Events matching the combination of Include and Exclude Filters will start the Correlation View timer. If subsequent events matching the combination of Filters are processed, then the Correlation View timer will be re-started.
Start - Include Filters
Select the Include Event Filter that identify events to be displayed in this Event View.
•New - Opens the Include Filter Wizard to create a new Include Event Filter.
•Properties - Select the filter and click Properties to edit or view the properties of an Event Filter.
Start - Exclude Filters
Exclude Filters are evaluated before the Include Filters. An Exclude Event that matches any of the Exclude Filters will not be displayed. This is a way to use multiple filters to display a focused subset of the events you want to isolate.
•New - Opens the Exclude Filter Wizard to create a new Event Filter.
•Properties - Select the Exclude Filter and click Properties to edit or view the properties of an Exclude Filter.
End - Correlation Filters
Events matching any of the End Correlation Filters within the time period will trigger all assigned Matching Notification Methods.
Watch for correlating event within this time period - This sets the duration for how long a Correlation View will watch for a Matching End event once a Start event has initiated the timer.
•New - Opens the Correlation Filter Wizard to create a new End Event Filter.
•Properties - Select the Correlation Filter and click Properties to edit or view the properties of an Correlation Filter.
If an Event matches any of the Correlation Filters within the time period, assigned Matching Notification Methods will be triggered, and the View itself will generate event 5708. If no Event is found within the time period, the assigned Timeout Notification Methods will be triggered, and the View itself will generate event 5707.
Notification Methods
Notifications can be triggered if correlating End events are found, or if they are not found, within the configured time period. The time period begins when an event matches the combination of Include and Exclude Filters assigned to the View.
Matching
The assigned Notification Methods are triggered if a correlating End event is found within the time period configured on the Filters End tab.
•New - Opens the Notification Method Wizard to select a Notification Method.
•Properties - Select the Notification Method and click Properties to edit or view the properties of a Notification Method.
Timeout
The assigned Notification Methods are triggered if a correlating End event is not found within the time period configured on the Filters End tab.
•New - Opens the Notification Method Wizard to select a Notification Method.
•Properties - Select the Notification Method and click Properties to edit or view the properties of a Notification Method.