Windows event log synchronization (agent side filtering)
-
In general I like this Feature.
Since every source can theoretically generate events with ID 0-65535, it should be possible to include/exclude a combination of source, level and ID (similar to Logwatch).
For example: A search for ID 1 on www.eventid.net shows a list of many different sources with different level.I tried some keywords, but with version 3.8.266 level or severity is not supported?
My first and most important step would be to exclude level 4 (information).
That would greatly relieve the database.I'm looking forward to new filter options.
Thanks in advance.
-
Hi,
just added severity filter option to wineventsync subagent. Now for every reader you can specify SeverityFilter parameter, which is either bit mask or severity level names separated by commas. Below are level names and their values:
Critical = 0x100
Error = 0x001
Warning = 0x002
Information = 0x004
AuditSuccess = 0x008
AuditFailure = 0x010To accept only warning and error events:
SeverityFilter = 0x012or
SeverityFilter = Warning,ErrorThis change will be included into next patch release.
Best regards,
Victor
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login