This article will help how to fix issues when searching the rule from events and logs are not using the proper search column

As an example, when we search the problematic rule from the events, it shows no output as per the below screenshot:

If we search the same manually, it is showing the output:

When searching for the working rule from the events, it shows output like this:

You will find below messages for working and non-working rules

Non-working search:

2024-09-30 15:42:50,112 DEBUG [net.juniper.space.sd.common.AbstractRuleManagerHandler] (default task-402) IN - getFilteredRuleIds - filterString = ((dcRuleGroupId = 1540126) and (RuleName like '%RULENAME%'))

Working search:

2024-09-30 15:45:05,921 DEBUG [net.juniper.space.sd.common.AbstractRuleManagerHandler] (default task-404) IN - getFilteredRuleIds - filterString = ((dcRuleGroupId = 1540126) and (ruleName like '%RULENAME%'))

Here the column name is RuleName for the non-working one which is wrong and ruleName for the working one.

To fix this issue, please follow the below steps

• Clone the policy and assign the device to it.
• Published and updated the policy.

The issue will be fixed permanently in 24.1R3