4 Replies Latest reply on May 9, 2008 2:28 PM by erharj

    Global Event Log Exclusions

    erharj

      In version 9 is there a method of configuring Winfows Event log Exclusions on a global level that applies to all Event Log monitors as opposed to configuring separate exclusions per monitor?

        • Re: Global Event Log Exclusions
          mark wiggans

           The Windows Event Log Monitor's Exclusions field cannot be altered using the Mass Edit utility. Instead, you would need export all Monitors to a XML file, perform a search and replace and then re import the XML. Here's how:

          1. Within the ipMonitor web interface, click "Settings -> Export Settings".

          2. Only leave "Export Monitors" checked.

          3. Click "Export".

          4. Copy the resulting XML from the new window into your favorite Text editor.

          5. Search for

            </info>
            <matches>

          and replace with:

            </info>
            <exclusions>
             <i0>
              <value>value-to-exclude</value>
             </i0>
            </exclusions>
            <matches>

          6. Copy the entire XML
          7. Go to "Settings -> Import Settings".
          8. Select the "Cut and Paste" option.
          9. Paste the entire XML into the text box
          10. Click "Import" .

          All of your Event Log Monitors should now have the exclusion

            • Re: Global Event Log Exclusions
              erharj

              That would work fine if I didn't already have existing exclusions on any event log monitors, but I do have many unique exclusions on every existing event monitor type, and I have a few hundred of them.

                • Re: Global Event Log Exclusions
                  mark wiggans


                  Another suggestion to try: 

                  Do a “backup now”, just in case.



                   



                  Export all the Monitors, and move
                  that text into a editor capable of doing regular expression search & replace
                  (and *very* long lines).



                   



                  Remove whitespace to make search /
                  replace easier. Replace !!regex!!



                  \>[ \r\n\t]+\<



                  with



                  >< 



                  Next, ensure that the exclusions
                  node exists in the xml. Replace (text)



                  </info><matches>



                  with:



                  </info><exclusions></exclusions><matches>



                   



                  Next, append a new Rule. Replace
                  (text)



                  </exclusions>
                  <matches>



                  with:



                  <inew>*HTMLENCODEDRULE</inew></exclusions>
                  <matches>



                   



                  * Add the rule, do a popup xml and
                  cut and paste the new value. This is just to avoid the headache of making sure
                  the XML encoding is properly done.



                   



                  Next, Import the new XML.



                    • Re: Global Event Log Exclusions
                      erharj

                      Seems clunky, I wish there was a way to do this.  Every time I try find/replace, something goes wrong somewhere in the file.  Any other ideas would be appreciated.  I'd like to Add, and Find/Replace all Event Log exclusions to all be equal....or if there was a method of creating a content rule or global behavior modifier or something I could point my event log monitors to for exclusions.