Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

syslog alert filter help needed

we are in the process of trying to create syslog alerts (emails) when 2 certain users gain enable access on our Cisco routers. We have tried using the following in regex and cannot seem to get it to work.

Can someone please help?

User:(user1|user2) logged command:!exec: enable

thank you

Find more posts tagged with

Accepted answers

All comments

sedmo

You could probably do this without using regular expressions by entering two different patterns separated by a comma.

*User: user1 logged command:!exec: enable*, *User: user2 logged command:!exec: enable*

PinkieT

@sedmo:

Thank you, we just figured it out. There are two spaces required between "User:user1" and "logged" which fixed our issue.

Thank you.