====== Rules and Creating Rules ======
----

===== Monitoring Rules View and Context Menu =====
----

From the Library, select the **Monitoring Rules** item to see a list of existing rules.

{{ monitoring:rules_and_creating_rules.png }}

The list shows the rule name, status (enabled or disabled), creation date, and the number of devices to which the rule applies.

Right-click any rule to access the contextual menu:

{{ rule:1.png }}

  ***Load Rule** : Assign the rule to a selection of devices. The monitoring rule is then loaded in the Command Queue and can be published to devices.
  ***Unload Rule** : Unload the rule from a selection of devices. This creates a Task to unload the rule which shall be published to desired devices.
  ***Show Details** : Display the rule details including triggers, polling frequency, and the list of devices to which the rule applies.

{{ rule:2.png }}

  ***Disable** : Disables the rule for all devices to which the rule applies.
  ***Edit** : Modify the rule's parameters.
  ***Remove** : Deletes the rule.

===== Create new Monitoring Rule =====
----

Create a new monitoring rule by clicking the {{icone:add.png}} button at the bottom of the screen.

{{ rule:3.png }}

To create a rule, define trigger(s) to form the Conditions list. All available triggers are detailed in the [[monitoring_and_preventive_maintenance:triggers_glossary|Triggers Glossary]].\\


**Xcalibur W** can record alerts as [[monitoring_and_preventive_maintenance:incident_management|Incidents]] whose start and end dates are the dates of the first and the last alerts received.


**Xcalibur W** can optionally assign a maintenance task to a particular rule. This feature automatically executes a task when an incident is open and/or is closed. A **Maintenance Task** can be any of the tasks in the [[library:task_templates|Task Templates]] section. 



**Xcalibur W** can optionally notify by sending e-mails. As a result, email recipients are notifed whenever an incident starts or stops. The recipient lists can be set in the [[notification:settings#e-mail_recipient_groups|Notification]] section.

===== Add Triggers =====
----

When you add a new trigger, the following configuration screen allows you to provide the parameters for the selected trigger : 

{{ rule:5.png }}

You can elect to define the number of consecutive matches for the condition that are required before raising an alert.

{{ rule:6.png }}

This option is available only for the following triggers : 

|sys.regexist|sys.gen.result|sys.serv.started|
|sys.partition.freespace|sys.diskdrive.health|sys.temperature|
|writefilter.cachesize.current|
===== Load/Unload Rule =====
----

To assign a rule to devices (or unload), click **Load Rule** on the contextual menu, or just double-click the rule. A new command named **Monitoring Rule** is added to the Command Queue and can be published to the selected devices. For more information, see [[manage_devices:publishing_tasks|Publishing Tasks]].

{{ rule:4.png }}

Rules are stored on the device file system in an unprotected area - part of the FBWF exclusions list.

|{{:warning.png |}} If the device(s) are protected by an EWF Write Filter,  [[commands_glossary:commands_to_multiple_devices#maintenance|activate/deactivate Maintenance mode]] in the task - otherwise, the rule may not persist onto the devices.|