Negate eventid in eventlog key

[javier.andres]

Hello,

I have got a little problem with the key eventlog...

I would like to catch all Windows System events less the 7035 and 7036 eventids.

I have tried to use the folllowing expression:

eventlog[System,,,,(^7035) | (^7036)]

But it doesn't work...

Does anyone know the correct way to do it?

Thanks,

[zalex_ua]

I have biggest experience with eventlog monitoring. See my related issue on the tracker - this is very useful for you. 1 2 3
Feel free to vote.

I would like to catch all Windows System events less the 7035 and 7036 eventids.

Very interestedly why?

I have tried to use the folllowing expression:

eventlog[System,,,,(^7035) | (^7036)]

This is not expression, this is an Item key with filtering by Agent side !!! More simply and correctly:

eventlog[System,,,,7035|7036]

This is key return only events with (like) ID 7035 and 7036 from Agent.

Does anyone know the correct way to do it?

Do make simple trigger for this events (with any severity levels) with expression:

{YouHost:eventlog[System,,,,7035|7036].logseverity(0)}>0

[javier.andres]

Hello zalex_ua,

7035 and 7036 are two examples... When you monitor a Windows computer, it is possible that this operating system returns some events which are not interesting for you, for example because there is a known situation that generates some problem, which is controlled but you cannot fix...

For that reason it is necessary in some cases to be able to catch all events less a few which are not interesting for you.

I already knew that the key item eventlog[System,,,,7035|7036] returns me only the 7035 and 7036 events, but I need a key item or trigger that returns me all System events less the 7035 and 7036 IDs... and the problem is that I don't know how to make it...

The solution that you propose only gives back these two events and I need all events less these two...

Thanks for your response!

[zalex_ua]

Hello zalex_ua,

but I need a key item or trigger that returns me all System events less the 7035 and 7036 IDs... and the problem is that I don't know how to make it...

try to use regexp:

^([1-6]?[0-9]{0,3}|70[0-2][0-9]|703[0-6])$