Forum Discussion
Hi Mark,
It is still possible to capture Windows Informational Events - that has not changed. All you need to do is add a filter that specifies the event ID of the Informational Event you want to capture. This has always been the requirement for capturing Informational events. The LEVEL filter option of 'Informational' had to be used in addition to the event ID filter, making it superfluous. That is why it was removed, but you shouldn't actually notice any difference in functionality with this removal. Re filtering based on event source and event ID, you can use the FILTEREDEVENTS property (or and eventID filter) to filter based on event ID and additionally add a sourcename filter to filter based on event source. Multiple filters are combined with a logical AND, so the captured events will be restricted to the specified source & Ids.
Thanks,
Sarah
Related Content
- 8 months ago
- 5 months ago