How to alert on a specific event id and exclude/filter the same event if it contains a specified string

+1 vote
asked Dec 29, 2017 in EventSentry Light by WILOG (160 points)
Trying to configure a package for a file server that sends an email on Event 4663.  This part is working.

Can you configure that the email is not triggered all the time? (eg. the event contains certain string)

1 Answer

0 votes
answered Dec 29, 2017 by Ingmar (3,390 points)
selected Dec 29, 2017 by WILOG
 
Best answer

Yes, there are two ways to configure EventSentry to only trigger an email if a certain text appears in the event.

Option 1
This method will match the string you supply in any part of the event (file name, user name, ...)

  1. Select the filter you want to customize
  2. In the "Content Filter & Notes" section of the filter, click the plus + icon
  3. In the resulting popup dialog, specify the string the event needs to include in order to match with a heading and trailing wildcard, e.g. *filename.txt". Click OK.
  4. To add multiple strings, simply repeat the process. Make sure that "Chain multiple content filters ..." is set to "OR" if you want the filter to match ANY of the content filters you put in place

Option 2
This method will only match the string you specify in the file name of the 4663 event.

  1. Select the filter you want to customize
  2. In the "Content Filter & Notes" section of the filter, click the plus + icon
  3. In the resulting popup dialog, select change the default option of "Wildcard match" to "Insertion string match"
  4. Select insertion string 7
  5. Specify the file name or part of the filename you want to include (match). Be sure to add a heading and/or trailing wildcard if you are only specifying a partial match, e.g. *somefile.doc
  6. To add multiple strings, simply repeat the process. Make sure that "Chain multiple content filters ..." is set to "OR" if you want the filter to match ANY of the content filters you put in place

Please also see our tutorials for more examples on how to setup filters: https://www.eventsentry.com/support/tutorials. You may also find our Youtube channel of interest: https://www.youtube.com/user/netikusnet

Welcome to EventSentry Q&A, where you can ask questions and receive answers from other members of the community.
...