topic Re: Is it possible to add an item to the whitelist in just one specific client in a server class? in Getting Data In

Is it possible to add an item to the whitelist in just one specific client in a server class?

JoanHorikawa — Thu, 12 May 2016 03:54:16 GMT

I have a server class (wineventlog) that has a whitelist in the inputs.conf. It looks like this:

[WinEventLog://Security]
disabled = 0
index = default
whitelist=4618,4621,4624,4625,4634,4649,4675,4692,4693,4706,4719,4720,4722-4735,4737,4738,4740,4744-4762,4765-4766,4794,4897,4964,1102,4648,5038,6281

This applies to all 14 clients in this server class. However, I want to add "2000" to the whitelist, but I need it in only one client out of the 14. Is this possible?

Re: Is it possible to add an item to the whitelist in just one specific client in a server class?

woodcock — Thu, 12 May 2016 04:33:01 GMT

Not that I can think of.

Re: Is it possible to add an item to the whitelist in just one specific client in a server class?

somesoni2 — Thu, 12 May 2016 07:00:01 GMT

Can't think of any native method, but you can try these work arounds

Create two copy of the app, one with current whitelist and one with additional 2000 to whitelist. Deploy current one to 13 servers and new (with additional whitelist) to that 1 server [probably easy]
Add 2000 to whitelist in the current app. On indexer side, create a transform to route the event to nullQueue if the host is not that one client (more complex)

Re: Is it possible to add an item to the whitelist in just one specific client in a server class?

jplumsdaine22 — Thu, 12 May 2016 08:38:40 GMT

I'd vote for option 1 - although if you don't already know about the nullQueue then do option 2 as it will be a useful exercise

Re: Is it possible to add an item to the whitelist in just one specific client in a server class?

lycollicott — Thu, 12 May 2016 13:15:21 GMT

I would also do option 1.

Re: Is it possible to add an item to the whitelist in just one specific client in a server class?

spayneort — Thu, 12 May 2016 16:02:14 GMT

Try using advanced filtering. Create a second whitelist that filters based on EventCode and ComputerName. Set ComputerName to the name of the client that you want to log the event.

[WinEventLog://Security]
disabled = 0
index = default
whitelist=4618,4621,4624,4625,4634,4649,4675,4692,4693,4706,4719,4720,4722-4735,4737,4738,4740,4744-4762,4765-4766,4794,4897,4964,1102,4648,5038,6281
whitelist1=EventCode="2000" ComputerName="insert name of client here"

Or you could create a new app that contains whitelist1 for event code 2000, and only apply it to the single client.

[WinEventLog://Security]
whitelist1=EventCode="2000"