# Element: rule

## Location

/[patterndb](../../../../../docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-patterndb/index.md)/[ruleset](../../../../../docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-ruleset/index.md)/[rules](../../../../../docs/axosyslog-core/chapter-parsers/chapter-patterndb/reference-parsers-pattern-databases/reference-patterndb-schemes/patterndb-scheme-rules/index.md)/_rule_

## Description

An element containing message patterns and how a message that matches these patterns is classified.

Note

If the following characters appear in the message, they must be escaped in the rule as follows:

  * `@`: Use @@, for example, `user@@example.com`

  * _<_ : Use `\&lt;`

  * _>_ : Use `\&gt;`

  * &: Use `\&amp;`




The __element may contain any number of __elements.

## Attributes

  * _provider_ : The provider of the rule. This is used to distinguish between who supplied the rule, that is, if it has been created by Axoflow, or added to the XML by a local user.

  * _id_ : The globally unique ID of the rule.

  * _class_ : The class of the rule — this class is assigned to the messages matching a pattern of this rule.




## Children

  * _patterns_



## Example
```
       <rule provider='example' id='f57196aa-75fd-11dd-9bba-001e6806451b' class='violation'>
    
```

The following example specifies attributes for correlating messages as well. For details on correlating messages, see [Correlating log messages using pattern databases](../../../../../docs/axosyslog-core/chapter-parsers/chapter-patterndb/configuring-pattern-databases/patterndb-correlation/index.md).
```
 
       <rule provider='example' id='f57196aa-75fd-11dd-9bba-001e6806451b' class='violation' context-id='same-session' context-scope='process' context-timeout='360'>
    
```

Last modified July 2, 2023: [Change highlight mode of code examples (2f8a959)](<https://github.com/axoflow/axosyslog-core-docs/commit/2f8a95937c6498193e7168ce8b0dc831e9f0f8ad>)