NAS pre-processing rules order

[Legacy User]

Is there ordering available under nas pre-processing rules in a similar manner like it is available for nas -->Auto-Operator-->Profiles. If it is not available then how does precedence works for Pre-processing rules?

[Garin Walsh]

There is no apparent execution order according to support when I asked the same question.

 

Additionally, nas only fires the first matching script. 

 

What I found was the only reasonable way of approaching this was to identify very basic filtering at the nas level (I have a test group of hub and a production group - I did this filtering at the nas level). Or maybe filter just enough to identify those messages that need processing from those that don't.

 

Then create a monolithic preprocessing script that incorporates the rest of the filter/processing logic.

 

It makes testing more cumbersome because each change affects the whole script potentially but it works.

 

-Garin 

[Legacy User]

Thanks for your response.

But I'm observing a situation as below suppose there are couple of preprocessing rules situation you might have encountered this as well:

Scenario-1
1-is an exclude rule

2-is custom where a script is executed

In this case the ouput of exclude is used by custom as feed. This enters into a loop as output of custom again is consumed by exclude as feed.

 

Scenario 2

1-is a custom where a script is enriching the source

2-is custom where a script is executed

In this case 2 does not trigger, 2 is only manipulating severity, and skips any output coming from 1.

I believe if ordering was available this could have been handled a lot easier
Though I've figured out a workaround as well but again I don't see the purpose of omitting ordering under preprocessing.

[Garin Walsh]

I do well understand the use case for ordering. I believe that I created an idea for this years ago.

 

But the function isn't there today in the nas so if you need it, you have to supply it yourself - And the short answer to that is to have only preprocessing criteria that is independent of execution order and uniquely matches a single message.

 

Then you implement the order dependant steps in the one matching preprocessing script.

 

-Garin

[Louis Savage]

There is indeed a processing order. I found this KB article which may help . You have to edit the cfg file by hand as there is no UI option to chnage the rule order something to keep in mind.

 

NAS preprocessing rules

Preprocessing rules can be defined using only filters and/or an Operating period. A specific order cannot be configured - that would be a feature request (Idea).

Preprocessing rules are processed as displayed in the GUI. To change the order in the GUI you need to change the order of the cfg.

'Custom' rules are first priority, 'excludes 'are second priority and 'invisible' are third priority.

nas preprocessing rules are executed 'top to bottom' of the nas.cfg, and the first match is the only one used.

 

NAS preprocessing rules and order - CA Knowledge