Need more granular way to filter event logs.
Currently the filtering capabilities for Windows Events are not granular enough to be very effective because there is no tie between Event ID and DataSource. This is a big problem because it is n...
Forum Discussion
I wasn't aware that different event sources would use the same event ID. Currently, I have a filter on all four eventsources that say
eventid regexnotmatch FILTEREDEVENTS
I have a property on the global level that has a long list of IDs that we do not want to see.
|
filteredevents
|
108|2028|9646|999|2156|2915|8010|1100|36888|36874|7011|56|10016|50|3004|11|9877
|
With this new knowledge about eventIDs not being unique, i will refactor the filters to use new properties FILTEREDIISEVENTS, FILTEREDSYSTEMSEVENTS, FILTEREDEXCHANGEEVENTS and etc etc.
Definitely not elegant but maybe that would work for you until Logicmonitor can create something better?
