PreviousNext

Filter Rules

Filter rules are used to resolve overlapping guides from different filters. There are two filter rules: the override and the high-water-mark.

Under the override rule, filters that are overridable (that is, cell_overridable and world_overridable types) are nullified by more specific filters. The override rule serves as a mechanism that allows for complementary filters. A filter for a principal or a group is more specific than a filter for a cell or for the world.

The high-water-mark rule is applied after the override rule. If multiple filters are applicable to a client, the union of the actions (log or alarm) specified by these filters is applied.

A filter is applicable to a client if its principal, groups, or cell identity matches the key of the filter. The world and world_overridable filters have no keys and are applicable to all clients. If there are multiple filters that are applicable to a client, then the union of the actions (log or alarm) specified by these filters is taken.