Event Log Confirguation

[Mukesh]

Hi Support Team,

Please confirm my Triger Expersion Correct or not


{Template EventLog:eventlog[Application].logseverity(2)}=2 & {Template EventLog:eventlog[Application].logsource("C:\Windows\System32\winevt\Logs\Applic ation")}=0

and i want to know =0 and #0 which is monitoring which is non-monitoring


Please help

Regards
Mukesh

[Kryol]

logsource trigger function define source of event (Source column at Event viewer) but not a file.

[Mukesh]

Thanks Kryol,

I understand :-

{Template EventLog:eventlog[Application].logseverity(2)}=2 & {Template EventLog:eventlog[Application].logsource("WMI")}=0


Please confirm =0 is monitoring or non-monitoring ?

We want to exclude certain logsource and string to non-monitoring/trigger alarm?

Thanks & Regards
Mukesh