exclude specific data with regex

[ltep]

Hi,
I have setup 2 items to monitor a specific event in the eventlog.

• item 1 : Windows event ID 4659: A handle to an object was requested with intent to delete.
  To collect Event ID 4659 this item has key: eventlog[Security,,,,^4659$,,skip]
  In the history of this item i can see all the events with Event ID 4659
• item 2 : Windows event ID 4659: A handle to an object was requested with intent to delete. - count
  This item counts the values of item 1 for the last hour. The item type is "Calculated" and is using formula count(/SERVER/eventlog[Security,,,,^4659$,,skip],1h)
  This works fine too...

I want to add 2 exclusions for the counting

• when a string like ~$ exist it should not be counted
• when a string like .tmp exist it should not be counted.

I think i need this regeular expression: ^(?!.*(?:~\$|\.tmp)).*4659.*$
When i change the formula in item 2 to count(/SERVER/eventlog[Security,,,,^(?!.*(?:~\$|\.tmp)).*4659.*$,,skip],1h) - the item gives error: Cannot evaluate function: item "/SERVER/eventlog[Security,,,,^(?!.*(?:~\$|\.tmp)).*4659.*$,,skip]" does not exist at "count(/SERVER/eventlog[Security,,,,^(?!.*(?:~\$|\.tmp)).*4659.*$,,skip],1h)".

An example of theraw output of the Windows event ID 4659:

A handle to an object was requested with intent to delete.

Subject:
Security ID: DOMAIN\user1
Account Name: user1
Account Domain: DOMAIN
Logon ID: 0x6CE3928

Object:
Object Server: Security
Object Type: File
Object Name: D:\~$test.xlsx
Handle ID: 0x0

Process Information:
Process ID: 0x4

Access Request Information:
Transaction ID: {00000000-0000-0000-0000-000000000000}
Accesses: DELETE
ReadAttributes

Access Mask: 0x10080
Privileges Used for Access Check:

[cyber]

Your initial item is still "eventlog[Security,,,,^4659$,,skip]" ... You cannot change key of target item in calculated item like this... You need to move that regex a bit, out of item key... into function parameters.
Your item: eventlog[Security,,,,^4659$,,skip]
Your calculated item (I hope it works): count(/SERVER/eventlog[Security,,,,^4659$,,skip],1h,"regexp","^(?!.*(?:~\$|\.tmp)).*4659.*$")

[ltep]

Hi Cyber,
Thank you

I think i'm still missing something...
This is what i have:

Item 1: eventlog[Security,,,,^4659$,,skip]
Item 2: count(/SERVER/eventlog[Security,,,,^4659$,,skip],1h,"regexp","^(?!.*(?:~\$|\.tmp)).*4659.*$")

It seems Item 2 stays at value 0. Even when Item 1 collected EventID 4659 from the EventLog without text string ~$ or .tmp

[ltep]

Your initial item is still "eventlog[Security,,,,^4659$,,skip]" ... You cannot change key of target item in calculated item like this... You need to move that regex a bit, out of item key... into function parameters.
Your item: eventlog[Security,,,,^4659$,,skip]
Your calculated item (I hope it works): count(/SERVER/eventlog[Security,,,,^4659$,,skip],1h,"regexp","^(?!.*(?:~\$|\.tmp)).*4659.*$")

Instead of using RegEx i tried to use Preprocessing on the item which collects the Event ID 4659 log.
The item key is eventlog[Security,,,,4659,,skip]

This is the Preprocessing configured on the item.

When the pattern ~$ or .tmp exists in the collected event, then the event itself is not stored in the history of the item.
I did a few tests with testfiles having the pattern in the filename and it seems to work.

For the counting i use item key: count(/SERVER/eventlog[Security,,,,4659,,skip],1h)
But for some reason it shows a negative number in Change which i don't understand.

[cyber]

so second to last value was 119?

[ltep]

I can't confirm because i cleared the history and trends.
But i can show the graph and raw values after the clear. I thought when counting the number only can increase?

[cyber]

Count of values in time period can differ I think... If your calculated item is calculated every minute, then this hour is sliding all the time... its 1h from that point back...

[ltep]

Yes, i was thinking the same cyber... but i couldn't find it in the documentation. It's resetting the value each hour. That's why it shows a negative value change once the next hour begins...