Event levels

#1 gavin.lacey@telegraph.co.uk

Example documentation reads 


<Select Path='Application'>*</Select> 

<Select Path='Security'>*[System/Level&lt;4]</Select> 

<Select Path='System'>*</Select>


I have <Select Path="ForwardedEvents">*</Select> can I specify the config as <Select Path="ForwardedEvents">*[System/Level&lt;4]</Select>

to pick up all log files as some are not forwarding

#2 NenadM

Hi Gavin

The XPath query you are asking about

<Select Path="ForwardedEvents">*[System/Level&lt;4]</Select> 

is more restrictive rule and will be discarding more events than 

<Select Path="ForwardedEvents">*</Select>

Have you tried using this module without filtering? Something like:

<Input eventlog> 
Module im_msvistalog