I'm sorry I didn't detail all of my problem.  I would like to eliminate PC's and
their interfaces from sending events.  In other words if a PC goes down, I don't
want it to show up at the TEC console, but if a router does it should show.  The
hardest thing to remove is "interface down" on the PC's, all I have to work with
is the last octet.  I would like to write a rule that states if the last octet
of the interface is > 50 then discard.  I realize I could hardcode all the
server routers ect.  but that would be a maintenance nightmare.  Any ideas how I
could accomplish this?