Eliminate .tmp and ~$ with filter?

Take out the "Exists" sets.  They are implied by the fact that you're looking at fields inside those events, and they're probably catching a lot of white noise.

Example: You don't need to tell the LEM to look for a FileDelete existing AND a field in FileDelete.  By looking for fields in FileDelete, the assumption is the FileDelete exists.

Hi Curtisi

Thank you for the reply. I have removed the exists part of the filter:

FileDelete.FileName /= (does not equal) *.tmp *~$  OR

FileCreate.FileName /= (does not equal) *.tmp *~$  OR       OR (overall)

FileDataWrite.FileName /= (does not equal) *.tmp *~$  OR

However, these events are still occurring.

Thanks

Just want to be clear, you are saying they are still showing up in events under that specific filter, or they are occurring just in general?

Showing up under that specific filter

I was re-reading your description of the filter, and I think it's dawned on me why it wasn't working.  Can you try importing this filter and see if it works better?

Thanks Curtisi. Your filter works if you close off the .tmp and ~$ with another * (e.g. *.tmp*).

Is there a way to setup FIM connector to ignore certain file extensions? It has "Conditions to watch for" and I wonder if it is possible to have it skip certain ones, instead of watching for them.

That probably needs to be a feature request.