Windows event log synchronization (agent side filtering)

[CURuser]

In general I like this Feature. 

Since every source can theoretically generate events with ID 0-65535, it should be possible to include/exclude a combination of source, level and ID (similar to Logwatch).
For example: A search for ID 1 on www.eventid.net shows a list of many different sources with different level.

I tried some keywords, but with version 3.8.266 level or severity is not supported?

My first and most important step would be to exclude level 4 (information).
That would greatly relieve the database.

I'm looking forward to new filter options. 

Thanks in advance.

[victor]

Hi,

just added severity filter option to wineventsync subagent. Now for every reader you can specify SeverityFilter parameter, which is either bit mask  or severity level names separated by commas. Below are level names and their values:

Critical = 0x100
Error = 0x001
Warning = 0x002
Information = 0x004
AuditSuccess = 0x008
AuditFailure = 0x010

To accept only warning and error events:

SeverityFilter = 0x012

or

SeverityFilter = Warning,Error

This change will be included into next patch release.

Best regards,
Victor