What is the difference between Real-Time Monitoring Rule Matching on Agent or Server (4254263)

What is the difference between Real-Time Monitoring Rule Matching on Agent or Server

InTrust Real-Time Monitoring has the following options on the Matching tab of each rule:

Perform rule matching on:

• Agent
• Server

What is the difference between the Agent and Server options?

Rule matching on "Agent" indicates:

• Agent matches rule (body only)

• Agent matched rule (pre-filter only)
• Server matches rule (both pre-filter and body)

The following sections of the InTrust Technical Insight Guide discuss rule matching: Real-Time Monitoring https://support.quest.com/technical-documents/intrust/11.2/technical-insight/real-time-monitoring Agent-Side Rule Matching https://support.quest.com/technical-documents/intrust/11.2/technical-insight/real-time-monitoring/agent-side-rule-matching Server-Side Rule Matching https://support.quest.com/technical-documents/intrust/11.2/technical-insight/real-time-monitoring/server-side-rule-matching