This configuration is disabled. <IsActive>false</IsActive> must be enabled with the %DEVICESERVERIPADDR% substituted with devserver ip by the customer. Until then, fallback would be enabled to DASL.

<SysConfig>
<Package>
<PackageID>21</PackageID>
<IsActive>false</IsActive>
<Event>
<MatchString>system-information-00767: System configuration saved by .* via</MatchString>
<ChangedBy>system-information-00767: System configuration saved by (.*) via</ChangedBy>
<PullConfig>1</PullConfig>
</Event>
<Event>
<MatchString>system-warning-00515: Admin user .* has logged</MatchString>
<ChangedBy>system-warning-00515: Admin user (.*) has logged</ChangedBy>
<NegativeMatchString>from %DEVICESERVERIPADDR%</NegativeMatchString>
<PullConfig>1</PullConfig>
</Event>
</Package>

This matches all syslog messages for pulls

<SysConfig>
<Package>
<PackageID>100</PackageID>
<IsActive>true</IsActive>
<Event>
<MatchString>.*</MatchString>
<PullConfig>1</PullConfig>
</Event>
</Package>

This filters out all messages; a <MatchString> is empty.

<SysConfig>
<Package>
<PackageID>100</PackageID>
<IsActive>true</IsActive>
<Event>
<MatchString></MatchString>
<PullConfig>1</PullConfig>
</Event>
</Package>
</SysConfig>

This is equivalent to <IsActive>false</IsActive> as there are no events.

<SysConfig>
<Package>
<IsActive>true</IsActive>
<PackageID>2000</PackageID>
<IsActive>true</IsActive>
</Package>
</SysConfig>

This is configured for Generic RME driver 2000. Notice the deviceName. This is used to extract the device name from the EMS message

<TrapConfig>
<Package>
<IsActive>true</IsActive>
<PackageID>2000</PackageID>
<Event>
<DeviceName>1.3.6.1.4.1.9.9.143.1.2.3.1.5.0:(.*)$</DeviceName>
<MatchString>1.3.6.1.4.1.9.9.143.1.2.3.1.7.0</MatchString>
<NegativeMatchString>User initiated archive update</NegativeMatchString>
<ChangedBy>1.3.6.1.4.1.9.9.143.1.2.3.1.8.0:(.*)$</ChangedBy>
<PullConfig>1</PullConfig>
</Event>