Eventlog monitoring and exclude some eventid

[Kryol]

Hi,

I have a trigger for eventlog monitoring e.g. for System Log Errors

{Template Windows Logging:eventlog[System].logseverity(0)}=4

Now I would like to exclude some events from triggering, e.g. event 27 for KDC

I modify this trigger as following

{Template Windows Logging:eventlog[System].logseverity(0)}=4 & ({Template Windows Logging:eventlog[System].logsource(KDC)}=1 & {Template Windows Logging:eventlog[System].logeventid(27)}#1)

So I need a trigger as A & (B & C)

Unfortunately it works as A & B & C and not triggering nothing (for KDC I have error 27 only).

Is it possible to use A & (B & C) or another solution?

[mgibson]

Did you ever find an answer for this? I'm running 2.0.4, and having the exact same issue.

[Kryol]

I can not find an answer.
It's strange. I have a trigger A & B | C | D & E | F which seems to work correctly but this A & (B & C) works as A & B & C

[mgibson]

Isn't A & (B & C) equivalent to A & B & C? No matter where you put the brackets, they all have to be true for the entire expression to be true.

Also, try .logseverity() without a zero in it.

[Kryol]

I need to switch trigger if A is true and B & C are true simultaneously.

For example above it mean that eventlog[System].logseverity(0)}=4 and eventid=27 for source KDC. I think it's A & (B & C).

Now I get A & B & C, i.e. if source is not KDC trigger does not switch.