Getting the correct select path setup | Log collection solutions

#1 rd237 7 years ago

I am wanting to see if this is possiable to put in a line for Input event log. 

 <Input eventlog>   

Module im_msvistalog   

SavePos FALSE   

ReadFromLast TRUE   

Query  <QueryList>\            

<Query Id="0">\             

<Select Path="System">*[System[(EventID=22 or EventID=1076 or EventID=6005 or EventID=6006)]] and *[System/Level=2]</Select>\             

</Query>\

</QueryList>

</Input>

Can i have this line in the select path along with just detecting event logs? I also want to monitor all Error messages. 

*[System/Level=2]

Permalink

#2 b0ti Nxlog ✓ 7 years ago (Last updated 5 years ago )

#1 rd237

I am wanting to see if this is possiable to put in a line for Input event log. <Input eventlog> Module im_msvistalog SavePos FALSE ReadFromLast TRUE Query <QueryList>\ <Query Id="0">\ <Select Path="System">*[System[(EventID=22 or EventID=1076 or EventID=6005 or EventID=6006)]] and *[System/Level=2]</Select>\ </Query>\ </QueryList> </Input> Can i have this line in the select path along with just detecting event logs? I also want to monitor all Error messages. *[System/Level=2]

See "XML Event Queries" section under the MSD documentation at https://msdn.microsoft.com/en-us/library/aa385231.aspx

You can also test and create your filters in Event Viewer and copy the XML from there.