Return
-
Title
What is the difference between Real-Time Monitoring Rule Matching on Agent or Server -
Description
InTrust Real-Time Monitoring has the following options on the Matching tab of each rule:
Perform rule matching on:
- Agent
- Server
What is the difference between the Agent and Server options?
-
Resolution
Rule matching on "Agent" indicates:
- Agent matches rule (body only)
Rule matching on "Server" indicates:- Agent matched rule (pre-filter only)
- Server matches rule (both pre-filter and body)
-
Additional Information
The following sections of the InTrust Technical Insight Guide discuss rule matching: Real-Time Monitoring https://support.quest.com/technical-documents/intrust/11.2/technical-insight/real-time-monitoring Agent-Side Rule Matching https://support.quest.com/technical-documents/intrust/11.2/technical-insight/real-time-monitoring/agent-side-rule-matching Server-Side Rule Matching https://support.quest.com/technical-documents/intrust/11.2/technical-insight/real-time-monitoring/server-side-rule-matching