Windows Event Log Passive Monitor filtering

Community Archive (Customer) asked a question.

Edited December 10, 2016 at 6:19 AM

G'day all. I'm setting up a new passive Windows Event Log Monitor and trying to filter out some unwanted entries. So far I'm not having much luck. The following is the payload from the entry I'm trying to filter out: ============================================================== ComputerName=IDC-MCFP User=NT AUTHORITY\SYSTEM Logfile=Security Type=audit failure EventType=5 SourceName=Security Category=2l CategoryString=Logon/Logoff EventCode=529l EventID=529l TimeGenerated=20141210162920.000000+660 TimeWritten=20141210162920.000000+660 Message=Logon Failure: Reason: Unknown user name or bad password User Name: HALMON01$ Domain: xxxxxxxx Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: HALMON01 ====================================================================== I'm trying to exclude any entries that have the User Name (in the "Message" ) "HALMON01$" I can quite easily filter on items in the event header (for example - "Event Type = 5") but trying to do this for the "Message" part where the text CONTAINS the user name I'm trying to filter it just isn't matching. I'd really appreciate some assistance here please. Thanks all! :-)

WhatsUp Gold General Discussions

Community Archive (Customer)
12 years ago
I don't have a lot of experience with passive Event Log monitors, so I don't know how to resolve this specific issue. But, I think that the problem might be with the way the XML in the event log is set up and configured. See this technet article on how to manually filter for a user or event in the logger, and you might be able to add this to an active script monitor. http://blogs.technet.com/b/askds/archive/2011/09/26/advanced-xml-filtering-in-the-windows-event-viewer.aspx
Expand Post

Related Questions