Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Daniel
Daniel
Explorer
Member since:
08-30-2010
06-05-2020
Community Statistics
| Posts | 6 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 08-30-2010 |
Activity Feed
- Posted Re: WMI: filter remote Eventlogs by Host Groups on Getting Data In. 08-31-2010 02:55 PM
- Posted Re: How to filter off winevent code to capture only failure audit status? on Getting Data In. 08-31-2010 12:16 PM
- Posted Re: WMI: filter remote Eventlogs by Host Groups on Getting Data In. 08-31-2010 08:07 AM
- Posted Re: WMI: filter remote Eventlogs by Host Groups on Getting Data In. 08-31-2010 07:20 AM
- Posted Re: WMI: filter remote Eventlogs by Host Groups on Getting Data In. 08-31-2010 07:19 AM
- Posted WMI: filter remote Eventlogs by Host Groups on Getting Data In. 08-30-2010 10:44 AM
- Tagged WMI: filter remote Eventlogs by Host Groups on Getting Data In. 08-30-2010 10:44 AM
- Tagged WMI: filter remote Eventlogs by Host Groups on Getting Data In. 08-30-2010 10:44 AM
- Tagged WMI: filter remote Eventlogs by Host Groups on Getting Data In. 08-30-2010 10:44 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
08-31-2010
02:55 PM
Finally I created two regex´ and defined the host twice..
[wmi_non_ad_697_lf]
REGEX = (?msi)ComputerName=(?!hosta|hostb).+?(EventCode=697|Type=Audit Success|Type=Success Audit|Type=.berwachung erfolgreich)
DEST_KEY = queue
FORMAT = nullQueue
[wmi_ad_697_lf]
# Alle AD Server mit EventCode 697 fliegen raus
REGEX = (?msi)ComputerName=(?=hosta|hostb).+?(EventCode=697)
DEST_KEY = queue
FORMAT = nullQueue
Not very splunk, but works.
... View more
08-31-2010
12:16 PM
I did it like that:
[wminull]
REGEX = (?msi)^(EventCode=697|Type=Audit Success)
DEST_KEY = queue
FORMAT = nullQueue
So it simply filters EventCode=697 OR Type=Audit Success to the null queue
... View more
08-31-2010
08:07 AM
wmi_type is set to WinEventLog:Security - no way to filter on my stanza. I would say I have different stanzas for nearly each log type. I have one stanza with three log files and another one with nine. The only thing is that I want to have all security logs from the second stanza and only failures from the first. I think I´m confused about stanzas and possible keys in the config files.
... View more
08-31-2010
07:19 AM
I think I mean different stanzas:
[WMI:Servers]
Disabled=0
event_log_file = Application, Security, System
interval = 5
server = hostA,hostB...
[WMI:AD]
disabled = 0
event_log_file = DFS Replication, Directory Service, DNS Server, File Replication Service, HardwareEvents, Key Management Service, Security, System, Application
interval = 5
server = HostF, HostG...
As I habe to define the hostname in wmi.conf I thought I can use this definition soewhere else. So I need to filter by hostname but I want to define the hostname only once and not in several files.
The forwarder is not the light one.
... View more
08-30-2010
10:44 AM
I would like to know wether it is possible to filter remote windows eventlog based on the groups inside wmi.conf.
I have a forwarder on a windows host, sending its messages to a linux box.
I defined a group server and a group active directory server.
I want all Security Eventlogs from the active directory group but only "Audit fails" from the other server group. EventCode 697 should never be forwarded.
Filtering all is easy:
props.conf
[wmi]
TRANSFORMS_wmi=wminull
transforms.conf:
[wminull]
REGEX = (?m)^(EventCode=697|Type=Audit Success|Type=Success Audit)
DEST_KEY = queue
FORMAT = nullQueue
Filtering should be placed on the forwarder for licensing reasons.
Anyone has an idea how to to this?
Thanks in advance.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
