Filters

Here is some documentation and example filters for use with Zoneminder. If you have a useful filter, please add it here.

Review the official documentation: https://zoneminder.readthedocs.io/en/stable/userguide/filterevents.html

Note About the PurgeWhenFull Filter and Additional HDDs

If you add a new HDD for data storage, you will need to adjust or add a new filter to delete events from the HDD. See: https://wiki.zoneminder.com/Using_a_dedicated_Hard_Drive

Examples

Receive Email From an Alarm on Weekends

For monitoring on the weekend you might have:

end date/time greater than or equal to -1 minute AND
alarm frames greater than or equal to 1 AND
Weekday equal to Saturday OR
Weekday equal to Sunday AND
alarm frames greater than or equal to 1 AND
date/time greater than or equal to -1 minute

Note that this is an example without brackets. Brackets can make this simpler. See further below for such an example.

The parameter end date/time greater than or equal to -1 minute will select events that occurred in the previous minute only.

Receive Email for a Specific Monitor on Sunday

Monitor id equal to ### AND
Cause not equal to Signal AND
End Date/Time greater than or equal to -1 minute AND
Alarm frames greater than or equal to 10 AND
Weekday equal to Sunday

Run Filter From the Command Line

From the forum:

You can use cron job to run the filter. Don't check the run in 
background box .. then in cron job run zmfilter.pl --filter_id=[whatever 
the id is].

(alt.)

sudo zmdc.pl status zmfilter .pl --filter_id=2 --daemon to see what zmdc.pl thinks about it.
sudo zmdc.pl start zmfilter .pl --filter_id=2 --daemon
Is basically how to web ui tells zmdc.pl to run it, so running that from command line should do the same thing.
ps ax | grep zmfilter should either list it or not.

Reference: https://forums.zoneminder.com/viewtopic.php?t=32112

Play Audio Notification Upon Alert

See forum post: https://forums.zoneminder.com/viewtopic.php?t=32650

Create Single Video of Multiple Events

https://forums.zoneminder.com/viewtopic.php?p=135958#p135958

Screenshots

Per request on the forum, here are some more examples that may help those just starting out. Note that 'message all details' requires the 'new email modules' to be enabled and configured (using MSMTP). For more details, see Email.

Delete False Alarms

Email Object Detected by ZMES

Reference: https://forums.zoneminder.com/viewtopic.php?p=126956

Email Object Detected by ZMES on Weekends Only

Example with brackets / parenthesis

The brackets can be confusing, so here's an example. This filter should fire off on any alerts that are on weekends.

Troubleshooting

Always Test the Filter with List Matches

Run the filter with 'list matches' after saving it. Errors in the generated SQL will be displayed. For example, one error might be to set EndStartTime to 'is' Sunday when it must instead be EndStartTime 'is equal to' Sunday.

Logging a Filter in Debug

Check off Debug log. Choose the filters you want to watch divided by a vertical line (e.g. _zmfilter_2|_zmfilter_3). Choose a destination that is e.g. /var/log/zm/zmfilter_debug_+ (otherwise it will go to the home folder by default). Tail the logs in the filesystem. If you have other questions refer to the question marks on options/logging for each entry. After you are done, disable logging.

Changes in 1.36: Filter Runs Before Event Completes

Past Zoneminder behavior was to run filters, after an event had completed. However in 1.36+, filters now run during an event. If you want the previous behavior, you will need to "Add an EndDateTime IS NOT NULL rule" https://forums.zoneminder.com/viewtopic.php?t=33409

Related Links

https://forums.zoneminder.com/viewtopic.php?f=42&t=29280 Filter - odd behavior with "and" and "or"

https://zoneminder.readthedocs.io/en/latest/userguide/filterevents.html#relative-items-in-date-strings

https://forums.zoneminder.com/viewtopic.php?f=40&t=28961 Filter issue - Less than X time doesn't seem to work