Blacklist windows event log by Host Application field

thund_ssi — Wed, 15 Jul 2020 02:00:23 GMT

Hello all,

I would like to exclude the following windows event log on the universal forwarder.

07/15/2020 08:38:55 AM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4103 EventType=4 Type=Information ComputerName=HA-AGM-DB-01.SSI.LOCAL User=NOT_TRANSLATED Sid=S-1-5-21-2993187273-2588912068-3154952105-14529 SidType=0 TaskCategory=Executing Pipeline OpCode=To be used when operation is just executing a method RecordNumber=90748 Keywords=None Message=CommandInvocation(Out-Host): "Out-Host" CommandInvocation(Out-Default): "Out-Default" ParameterBinding(Out-Default): name="Transcript"; value="True" Context: Severity = Informational Host Name = ApmPSHost Host Version = 1.0 Host ID = 85e424db-4fce-46cb-90d4-bace72bb3e2a Host Application = SWJobEngineWorker2.exe 3e167b33-0a26-4f7e-9964-e38b1e939cc6 6612 AgentPlugin SolarWinds.APM.Probes Engine Version = 5.1.14393.3383 Runspace ID = 3c6aab92-96b5-464d-8659-0e81de6d4ec9 Pipeline ID = 1 Command Name = Command Type = Script Script Name = Command Path = Sequence Number = 193 User = xxxxx Connected User = Shell ID = Microsoft.PowerShell User Data:

Tried with this blacklist :

blacklist = EventCode="4103" Message="Host\sApplication\s=*SolarWinds.APM.Probes"

Re: Blacklist windows event log by Host Application field

anmolpatel — Wed, 15 Jul 2020 06:15:21 GMT

*Updated* Have a try with this blacklist stanza:

blacklist1 = EventCode="4103" Message="Host Application\s=\s*.*SolarWinds\.APM\.Probes"

Re: Blacklist windows event log by Host Application field

thund_ssi — Wed, 15 Jul 2020 03:35:39 GMT

Thanks, but not working

Re: Blacklist windows event log by Host Application field

thund_ssi — Wed, 15 Jul 2020 06:09:50 GMT

I got it:

blacklist1 = EventCode="4103" Message="Host Application =\s+.*SolarWinds.APM.Probes"

topic Re: Blacklist windows event log by Host Application field in Getting Data In

Blacklist windows event log by Host Application field

Re: Blacklist windows event log by Host Application field

Re: Blacklist windows event log by Host Application field

Re: Blacklist windows event log by Host Application field