MARS query - Save as rule

Right now most of the rules I am creating are drop rules while doing the initial tuning of my MARS box. When I use the query to save as a rule, it apprears that you can only save it as an inspection rule and never as a drop rule. Am I missing something?

Hi,
That's a question in very relationship with another I've posted. I can create lots of inspection rules based on keywords but I can not create a drop rule based on that. P.e. There's a lot of logs originated in domain controllers that I'm able to classify them based on "User Name: Local-Admin" words and their source IP. I'm sure that's correct and I want to drop all events. It's not possible. I can only create an inpection rule, not a drop rule.
Thanks a lot.

Similar Messages

Default query save location in SSMS 2012

So, finally, is there a way to change SSMS 2012 default query save location?
Scenario:
1. Open SSMS
2. Create new query
3. Click Save
I see "Documents\SQL Server Management Studio" folder, but I want to change it to be "d:\". How do I do this?
I tried:
1. http://visualstudiohacks.com/options/changing-the-my-projects-folder-location-and-other-settings-in-ssms/ - in folder "Documents\SQL Server Management Studio\Settings\SQL Server Management Studio\" there is a file NewSettings.vssettings,
setting it to "d:\" or "d:\\" didn't help.
2. Changing HKEY_CURRENT_USER\Software\Microsoft\Microsoft
SQL Server\100\Tools\Shell VisualStudioProjectsLocation didn't help too. There is no "Shell" under "110\Tools\"
Did I do something wrong, or is there another way?

try this
http://visualstudiohacks.com/options/changing-the-my-projects-folder-location-and-other-settings-in-ssms/
Regards,
Praveen D'sa
MCITP - Database Administrator - 2008
sqlerrors
Hi Praveen,
Based on my test, the solution in the link your post works in SSMS of SQL Server 2005, 2008 and 2008 R2 version. However, in SQL Server 2012, the configuration of SSMS is changed.
Regards,
Fanny Liu
Fanny Liu
TechNet Community Support

Query on Counting Rules for CL

Our customer has the following requirement regarding Casual Leave (CL). If the CL days are BOTH prefixed & suffixed by OFF days and/or holidays then ONE extra day of CL is to be counted. E.g. Assume an employee takes one day CL on 5-Mar-12, 6-Mar-12 and 4-Jan-12 is his weekly OFF and 7-Mar-12 is a holiday. Then CL days days have to be counted as 2+1 = 3 days (one day extra).
However, if CL days are only prefixed or only suffixed with OFF days or holidays, then the actual CL days have to be counted. E.g. employee takes CL on 8-Mar-12 and 7-Mar-12 is a OFF day or holiday. Then only ONE day CL (Actual) is to be counted. Similarly, if employee takes CL on 9-Mar-12 and 10-Mar-12 is a OFF day or holiday, then also only ONE day Cl (actual) is to be counted.
Please guide me on how to configure the counting rules for the above scenarios.
-Kalpana

Hi,
Check all the week days, Allholiday class, All the DWS class, conditions for day selected in countingrule.
With same counting rule number with other grouings i.e ESG grouping for Time quotas, PSG grouping for Time Quotas with different cobination having any collution. in case of employee subgroup changes it may reflect.
Eventhough everything is fine then already updated employee master again you need to save the masterdata with change mode through PA30.

Query Save As Problem

i am in a situation, need your help....
When I try to save as an existing query, I see only only favorites and roles on save query as window. but i want to save in the same infoarea. the infoareas list is not displayed at all. is there a way i can get the infoareas icon on the left?
or is it an authorization issue?

Actually, if i try to go ahead as you said....a dialog box 'Create Object Directory Entry' is popping up. i think this is from transport mgmt. asking to enter package info.
this did not happen to me earlier.
to give some details: I chose favorites. do i have to choose roles instead? if yes, waht role to choose.

How to use bind variables in "query result" "validation rule"

I have created a validation rule on my entity object. rules=compareValidator attribute=InvoiceNumber operator=NotEquals queryResult=SELECT ...
In this query, I would like to reference entity attributes from the current instance of the entity when the value fires, for example SELECT invoice_number where invoice_id != :invoiceId
How can I reference a bind variable inside the query result compare validator validation rule?
THanks,
Jerry.

bump

SAP Query : Save to file in XLS format in background

Hello everybody,
I used the enhancement SQUE0001 for saving result (an XLS file) of SAP query in background.
I used also the ABAP commands 'OPEN DATASET', 'TRANSFER' and 'CLOSE DATASET' as described in the SAP note 537735.
The execution of SAP query generated multiple columns. But when I go to see my downloaded file (.xls), all generated columns are condensed into 1 !!!
How to save the file (.xls) and keep the separated columns, please?
Thanks for your answers.

For saving the file in Excel format in the App server you have to first convert the data in XLS format and then use the transfer statement.
You can either use FM SAP_CONVERT_TO_XLS_FORMAT for that.
OR
Create a comma sepreated file which will open in excel.
open dataset file for output in text mode.
loop at itab.
    concatenate itab-field1 itab-field2 itab-field2 into str
                  separated by ','.
    transfer str to file.
endloop.
close dataset file.

Web query- save view locally (in favorites folder)?

Hello all,
is it possible to save a query view locally (in ones favorites folders) when only working with a query on the web?
Thanks in Advance!
Elisabeth

I thought BW saves query view in Favorites by default. At least in ver. 3.5.
<a href="https://www.sdn.sap.comhttp://www.sdn.sap.comhttp://www.sdn.sap.com/irj/sdn/weblogs?blog=/pub/u/37289">vitaliy</a>

Query required for rule

Below is the condition for which a query is to be written.
as of now this the query i have written. am getting the orderids which satisfy this rule but the output should include all those orderids which already satisfy the rule.(i.e the current o/p contains those orderids which share a common circuitid and have same start and end dates. the output required should include this as well as those orderids tat do not share circuitids.
or
the o/p should contain those orderids which do not fall into any of these categories)
The Rule:
For the Entity Circuit Orders if the Circuit Id is same for two different order IDs then the Order Start Date for the Order Id having Order Status as Installed should be same as the Order End Date for the Order Id having Order Status as Retired.
Tthe query:
select order_id from managed_element1 where order_status = 'I' and order_start_date in
(select order_end_date from managed_element1 where circuit_id in
(SELECT circuit_id FROM managed_element1 where order_status='R' GROUP BY circuit_id))

The data is as below
Order_id circuit_id start_date end_date order_status
ORDER_67 BORDER_2 03/05/06 05/09/06 R
ORDER_7 BORDER_6 10/26/06 I
ORDER_11 BORDER_7 12/05/06 12/06/07 I
ORDER_1 BORDER_2 05/09/06 05/19/06 R
ORDER_2 BORDER_2 05/19/06 I
ORDER_3 BORDER_3 04/03/06 05/20/06 R
ORDER_4 BORDER_3 05/20/06 I
ORDER_5 BORDER_4 02/05/06 05/06/06 R
ORDER_6 BORDER_4 05/05/06 I
ORDER_7 BORDER_5 10/22/02 02/23/03 R
ORDER_8 BORDER_5 02/23/03 I
ORDER_9 BORDER_6 03/12/06 09/26/06 R
ORDER_10 BORDER_6 09/26/0610/26/06 R

Change MARA at save MM01/MM02

HI ABAP experts,
i would like to change some fields in MARA when i save at MM01/MM02. Is there any exit or badi where i can do this?
Thx
Hannes
Moderator message: Welcome to SCN. Please always search for available information/documentation and previous discussions of the same topic before posting.
Edited by: Thomas Zloch on Jan 13, 2012

Searching in SDN can help you the best. there are many threads for this. please search

MARS General FP Drop Rule vs. Listed Unconf. FPs

I have a gazillion (really!) Unconfirmed False Positive events listed on that Tab in MARS. The specific event is "Windows SMB Enum Share DoS" and I created a Drop Rule for ANY of these events, with Source and Destination from my inside networks. I know all of my systems are patched against it.
It appears my Drop Rule is working, since viewing the Sessions associated with these (clicking the "Show" link at the right of each) shows no sessions after I installed the Drop Rule.
But I still have all of these Events in the Unconf. FP list. I would like to avoid doing the "False Positive" procedure for each, for two reasons:
1. It will take a long time.
2. I will also wind up with a gazillion Drop Rules, which the system will either have to process OR I'll have to go through THEM and Inactivate them.
Any ideas?
Paul Trivino

Try this to prevent System Determined False Positives from displaying as incidents?
If you confirm what was previously an unconfirmed false positive, then a
drop rule is created. That drop rule should prevent any further incidents
of that type. So, this shouldn't be happening. Please make sure you've
clicked `Activate'.
Check the related bug-id:CSCsc74104

MARS Query 'Hit-Count' versus 'Total-Count'

Hi, I have a question about MARS queries: I run queries using 'custom columns' and I continually hit over 5000 entries. I was wondering if there is a way to show the following:
Custom Colums:
- event type set
- source IP address
- destination IP address, port, and protocol
- <NEW FIELD> 'Hit-count'
The reason I posit the 'Hit-count' field is that this would help me see everything that happened on the first three columns and not limit me when MARS says 'only the first 5000 entries will be displayed'.
If there is any way to count the number of times it happened in a hit-count field, versus counting the number of times it happened and then limiting the displayed results, I would think that would be tremendously useful.
Please let me know if there is already a way to do this, or if there are any plans to add this! Thanks!

Don't know about queries, but you define 'Count' in MARS rules, so you could clone the built-in rule and perhaps modify the count value to suit your needs. I know this is not exactly what you are looking for but it might get you going in the right direction. You also have the following variables to play with to further suit your needs:
ANY-(Default). Signifies that the IP address for each count is any IP address.
SAME-Signifies that the IP address for each count is the same IP address. This variable is local to its offset.
DISTINCT- Signifies that the IP address for each count is a unique IP address. This variable is local to its offset.
$Target01 to $Target20-The same variable in another field or offset signifies that the IP address for each count is the same IP address.
Have a look at:
http://ciscosystems.com/univercd/cc/td/doc/product/vpn/ciscosec/mars/5_3/uglc/rules.htm#wp1054961
Also on strange idea, but it might work, in the "Maximum Number of Rows Returned" why don't you try and put 1000, does the MARS accept that? I seriously doubt it would work, but worth a try. I think they used to have an even lower limit in older version (1000).
Regards
Farrukh

Userexit/BADI change MARA at save

Hi experts,
i need an userexit or a badi to change the mara-table before i save in MM01/MM02. Can anybody help me?
Thx.
Cheers
Hannes
Moderator Message: Please search before posting.
Edited by: Suhas Saha on Jan 14, 2012 3:54 PM

Searching in SDN can help you the best. there are many threads for this. please search

How do you save css rules created in web inspector?

Being a web developer, I usually use Firebug on Firefox to test CSS when I'm developing a website. Ever since I got my new iMac, I've really grown to love Safari. I like the Web Inspector but I cannot seem to find a way to copy any of the CSS rules I create for testing. Is there an effective way to create CSS rules and copy the whole CSS rule (property + declarations) so I can paste them somewhere else?

You can import and replace any styles you want from other documents, but templates are templates. That is what they are for.
Styles are document specific for a reason. Imagine the fun and games if the styles in one document changed the behavior of same name style in other unopened documents. You would be chasing your tail forever.
Someone would send you a file and it would inexplicably change layout and appearance just because your styles didn't match.
Peter

CF query save as xls file

I have a little problem and I hopw anybody could help me.
I have a normal select statement and I want to run the select
and have a SAVE AS button directly on the site to save a XLS file?
Please help me ASAP!

The code below should get you started. Place it immediately
after the <BODY> tag on your page. Place <CFOUTPUT>
before your <TABLE> tag, and </CFOUTPUT>
after your </TABLE> tag.
Within your table, each <TR> creates a new spreadsheet
row and each <TD> creates a spreadsheet cell. You may have to
do a File > Save As from your browser menu to save it as a Excel
spreadsheet.

Mail 6 DID NOT save my rules and signatures: how do I get the RULES back?

When I had the UNFORTUNATE idea to switch (that is to DOWNGRADE imho) from 10.6.8, the new Mail, among the MANY PROBLEMS IT CREATED TO ME (see my other posts about blocked plug-in messages, etc.), DID NOT care at all about saving my signatures and rules.
I found the signatures as webarchives in user/library/mail/v2/mail data/signatures, and just clicked on each one and did LOTS of TIME CONSUMING copy-paste to CREATE new signatures from within mail preferences.
I wasn't able to do the same for the MANY rules I had.
Also, in the previous Mail, it was possible to simply do a command-f inside the To or Bcc fields to check if I had forgotten someone. Now it is NOT POSSIBLE any longer. Anyone knows ho to re-establish that possibility?
Any help would be appreciated.

I went back to the MUCH BETTER Snow Leopard and I have NONE of the problems I encountered with the windoz-like "lions", I have my fast and perfectly functioning computer and system with 10.6.8

MARS query - Save as rule

Similar Messages

Maybe you are looking for