The Windows Event Log Monitor's Exclusions field cannot be altered using the Mass Edit utility. Instead, you would need export all Monitors to a XML file, perform a search and replace and then re import the XML. Here's how:
1. Within the ipMonitor web interface, click "Settings -> Export Settings".
2. Only leave "Export Monitors" checked.
3. Click "Export".
4. Copy the resulting XML from the new window into your favorite Text editor.
5. Search for
and replace with:
6. Copy the entire XML
7. Go to "Settings -> Import Settings".
8. Select the "Cut and Paste" option.
9. Paste the entire XML into the text box
10. Click "Import" .
All of your Event Log Monitors should now have the exclusion
That would work fine if I didn't already have existing exclusions on any event log monitors, but I do have many unique exclusions on every existing event monitor type, and I have a few hundred of them.
Another suggestion to try:
Do a “backup now”, just in case.
Export all the Monitors, and move
that text into a editor capable of doing regular expression search & replace
(and *very* long lines).
Remove whitespace to make search /
replace easier. Replace !!regex!!
Next, ensure that the exclusions
node exists in the xml. Replace (text)
Next, append a new Rule. Replace
* Add the rule, do a popup xml and
cut and paste the new value. This is just to avoid the headache of making sure
the XML encoding is properly done.
Next, Import the new XML.
Seems clunky, I wish there was a way to do this. Every time I try find/replace, something goes wrong somewhere in the file. Any other ideas would be appreciated. I'd like to Add, and Find/Replace all Event Log exclusions to all be equal....or if there was a method of creating a content rule or global behavior modifier or something I could point my event log monitors to for exclusions.