Hello.
I need to monitor events with EventCode="4656 on windows server. But only events with string "ObjectType: File" in Message.
**inputs.conf**
Blacklist1 = EventCode="4656" Message="ObjectType:\s+(!?File)"
But with my conf it doesn't work.
Where is mistake?
↧