Exclusions

An Exclusion is a pattern whose matching events are hidden from the live dashboard feed. It does not affect stored data, search results, or alerts — only what the dashboard displays.

Matching is literal, not regex

Event.recent_events collects every Exclusion pattern and rejects lines matching Regexp.union(patterns). Regexp.union escapes metacharacters, so:

• sshd.*fail matches those seven characters literally, not "sshd" followed by "fail".
• There is no way to write a wildcard in an Exclusion. It is a substring-style filter over the raw line.

This is a deliberate, documented behaviour rather than a bug: the alternative was letting an operator's pattern become an arbitrary regex evaluated on every dashboard poll.

Blank patterns are ignored

Regexp.union([""]) is //, which matches every line — a single blank Exclusion used to empty the dashboard for every user. Blank and nil patterns are dropped before the union is built.

The feed self-tunes

recent_events starts from the size stored in Preference.eventsDashboard and adjusts it so the feed converges on roughly 50–70 lines however noisy the exclusions are: under 50 survivors grows the fetch 10%, over 70 shrinks it 5%. Growth only pays off when the fetch was actually truncated, so the number does not climb forever on a quiet install.

The tuning is read-only on the request path — GET /events is polled every 60 seconds by every open dashboard tab, and a page being looked at must not issue an UPDATE. The tuned value is persisted by the tune_dashboard_feed job. See Jobs.

Permissions

Exclusions are behind the Commentator right.