Filters

Here is some documentation and example filters for use with Zoneminder. If you have a useful filter, please add it here.

Review the official documentation: https://zoneminder.readthedocs.io/en/stable/userguide/filterevents.html

Note about purgewhenfull and Additional HDDs

If you add a new HDD for data storage, you will need to adjust or add a new filter to delete events from the HDD. See: https://wiki.zoneminder.com/Using_a_dedicated_Hard_Drive

Examples

Receive email alarm on Weekends

For monitoring on the weekend you might have:

end date/time greater than or equal to -1 minute AND
alarm frames greater than or equal to 1 AND
Weekday equal to Saturday OR
Weekday equal to Sunday AND
alarm frames greater than or equal to 1 AND
date/time greater than or equal to -1 minute

Note that this is an example without brackets. Brackets can make this simpler. See below for such an example.

The parameter end date/time greater than or equal to -1 minute will select events that occurred in the previous minute only.

Receive email for specific monitor on Sunday

Monitor id equal to ### AND
Cause not equal to Signal AND
End Date/Time greater than or equal to -1 minute AND
Alarm frames greater than or equal to 10 AND
Weekday equal to Sunday

Run filter from the command line

From the forum:

You can use cron job to run the filter. Don't check the run in 
background box .. then in cron job run zmfilter.pl --filter_id=[whatever 
the id is].

(alt.)

sudo zmdc.pl status zmfilter .pl --filter_id=2 --daemon to see what zmdc.pl thinks about it.
sudo zmdc.pl start zmfilter .pl --filter_id=2 --daemon
Is basically how to web ui tells zmdc.pl to run it, so running that from command line should do the same thing.
ps ax | grep zmfilter should either list it or not.

Play audio notification upon alert

See forum post: https://forums.zoneminder.com/viewtopic.php?t=32650

ZMES example

Reference: https://forums.zoneminder.com/viewtopic.php?p=126956

Example with brackets / parenthesis

The brackets can be confusing, so here's an example that makes it clear. This filter should fire off on any alerts that are on weekends.

Create Single Video of Multiple Events

https://forums.zoneminder.com/viewtopic.php?p=135958#p135958

Gallery of Examples

Per request on the forum, here are some more examples that may help those just starting out. Note that 'message all details' requires the 'new email modules' to be enabled and configured (using MSMTP). For more details, see Email.

Troubleshooting

Always Test the Filter with List Matches

Run the filter with 'list matches' after saving it. Errors in the generated SQL will be displayed. For example, one error might be to set EndStartTime to 'is' Sunday when it must instead be EndStartTime 'is equal to' Sunday.

Logging a Filter in Debug

Set ZM Component Files to Debug. Check off Debug log. Choose the filters you want to watch divided by a vertical line (e.g. _zmfilter_2|_zmfilter_3). Choose a destination that is e.g. /var/log/zm/zmfilter_debug_+ (otherwise it will go to the home folder by default). Tail the logs in the filesystem. If you have other questions refer to the question marks on options/logging for each entry. AFter you are done, disable logging.

Changes in 1.36: Filter Runs Before Event Completes

Past Zoneminder behavior was to run filters, after an event had completed. However in 1.36+, filters now run during an event. If you want the previous behavior, you will need to "Add an EndDateTime IS NOT NULL rule" https://forums.zoneminder.com/viewtopic.php?t=33409

Related Links

https://forums.zoneminder.com/viewtopic.php?f=42&t=29280 Filter - odd behavior with "and" and "or"

https://zoneminder.readthedocs.io/en/latest/userguide/filterevents.html#relative-items-in-date-strings

https://forums.zoneminder.com/viewtopic.php?f=40&t=28961 Filter issue - Less than X time doesn't seem to work