Event levels
Example documentation reads
<Select Path='Application'>*</Select>
<Select Path='Security'>*[System/Level<4]</Select>
<Select Path='System'>*</Select>
I have <Select Path="ForwardedEvents">*</Select> can I specify the config as <Select Path="ForwardedEvents">*[System/Level<4]</Select>
to pick up all log files as some are not forwarding
Hi Gavin
The XPath query you are asking about
<Select Path="ForwardedEvents">*[System/Level<4]</Select>
is more restrictive rule and will be discarding more events than
<Select Path="ForwardedEvents">*</Select>
Have you tried using this module without filtering? Something like:
<Input eventlog>
Module im_msvistalog
</Input>