Anyway to set up a filter to to exclude a string ending with "$". What I'm attempting to do is alert on large number of file changes by non-system accounts.
Have you tried the $ logic with a simple *$* notation in the filter and ndepth to verify the logic works?
