It seems you could use a combination of match and ignore settings to achieve what you're looking for? Might take some work but I'm sure you could get there.
<match logfile="System" value="text string you're looking for" source="source of the event" eventid="0000" /> <ignore logfile="System" value="text string you don't want" type="types you don't want" /> <ignore logfile="Application" source="source types you don't want" type="types you don't want" /> <ignore logfile="Security" source="source types you don't want" type="types you don't want" eventid="id's you don't want" /> Etc Etc Etc
Might work?
From: xymon-bounces at xymon.com [mailto:xymon-bounces at xymon.com] On Behalf Of Nordquist, Daniel Sent: Wednesday, March 09, 2011 1:08 PM To: Camelia Anghel; xymon at xymon.com Subject: Re: [Xymon] BBWin word pattern
Does the word pattern you want to search for show up in the data on your hobbit server when you click on the msgs icon?
From: Camelia Anghel [mailto:canghel at cjh.org] Sent: Wednesday, March 09, 2011 12:59 PM To: Nordquist, Daniel Subject: RE: BBWin word pattern
Yes, I want to look in the data of the log for word pattern. Thanks Camelia From: Nordquist, Daniel [mailto:Daniel.Nordquist at orlandohealth.com] Sent: Wednesday, March 09, 2011 12:55 PM To: Camelia Anghel; xymon at xymon.com Subject: RE: BBWin word pattern
No difference in the type or source of the event logs? You want to look in the data of the log for your word pattern?
From: xymon-bounces at xymon.com [mailto:xymon-bounces at xymon.com] On Behalf Of Camelia Anghel Sent: Wednesday, March 09, 2011 12:35 PM To: xymon at xymon.com Subject: [Xymon] BBWin word pattern
Hello, I have BBWin-0.12 and I am trying to shrink the EventLog msgs . Is there a way to use word pattern in the local-config.cfg file on the windows client? I would like to keep some EventLog id's with a certain pattern, but not all. Thanks, Camelia
Camelia Anghel Database Coordinator Center for Jewish History 15 West 16 St, New York, NY 10011 phone:(917)606-8248 canghel at cjh.org
This e-mail message and any attached files are confidential and are intended solely for the use of the addressee(s) named above. If you are not the intended recipient, any review, use, or distribution of this e-mail message and any attached files is strictly prohibited.
This communication may contain material protected by Federal privacy regulations, attorney-client work product, or other privileges. If you have received this confidential communication in error, please notify the sender immediately by reply e-mail message and permanently delete the original message. To reply to our email administrator directly, send an email to: postmaster at orlandohealth.com .
If this e-mail message concerns a contract matter, be advised that no employee or agent is authorized to conclude any binding agreement on behalf of Orlando Health by e-mail without express written confirmation by an officer of the corporation. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of Orlando Health.
This e-mail message and any attached files are confidential and are intended solely for the use of the addressee(s) named above. If you are not the intended recipient, any review, use, or distribution of this e-mail message and any attached files is strictly prohibited.
This communication may contain material protected by Federal privacy regulations, attorney-client work product, or other privileges. If you have received this confidential communication in error, please notify the sender immediately by reply e-mail message and permanently delete the original message. To reply to our email administrator directly, send an email to: postmaster at orlandohealth.com .
If this e-mail message concerns a contract matter, be advised that no employee or agent is authorized to conclude any binding agreement on behalf of Orlando Health by e-mail without express written confirmation by an officer of the corporation. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of Orlando Health.
This e-mail message and any attached files are confidential and are intended solely for the use of the addressee(s) named above. If you are not the intended recipient, any review, use, or distribution of this e-mail message and any attached files is strictly prohibited.
This communication may contain material protected by Federal privacy regulations, attorney-client work product, or other privileges. If you have received this confidential communication in error, please notify the sender immediately by reply e-mail message and permanently delete the original message. To reply to our email administrator directly, send an email to: postmaster at orlandohealth.com .
If this e-mail message concerns a contract matter, be advised that no employee or agent is authorized to conclude any binding agreement on behalf of Orlando Health by e-mail without express written confirmation by an officer of the corporation. Any views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of Orlando Health.