If you need to compare two values in NXSL, you should use == operator. Operator = is an assignment. So, if your script really uses = instead of ==, it's one mistake. Also, don't forget that any event passes all rules, except if matching rule contains "stop processing" option. You have to add it to your rule. Also, interface name always passed as parameter number 2 with SYS_IF_DOWN and SYS_IF_UP events, so you can compare just it's value to {5757FA85-B187-42A4-981C-7443B4ECFC90} instead of comparing full message text. So, I suggest the following rule:
event:
SYS_IF_DOWN
SYS_IF_UP
source:
any
severity:
any
script:
$2 == "{5757FA85-B187-42A4-981C-7443B4ECFC90}"
alarm:
none
actions:
none
options:
stop processing
Should work
Best regards,
Victor
event:
SYS_IF_DOWN
SYS_IF_UP
source:
any
severity:
any
script:
$2 == "{5757FA85-B187-42A4-981C-7443B4ECFC90}"
alarm:
none
actions:
none
options:
stop processing
Should work
Best regards,
Victor