Filter Conditions

Created 2004-03-03 by Rainer Gerhards.

Adiscon MonitorWare Agent, WinSyslog and EventReporter offer very powerful filter conditons. Unfortunately, they are not always easy to understand. This page here lists all ressources helping you understand how filters work and how they can be applied. Please note that the samples below contain some rather complex filters.

Demo / Seminar

• A demo of how the filter dialog can be used for complex conditions (screen cam). Highly recommended for understanding how the filter dialog works.
  [High quality (300KBps)] [Low quality (50KBps)]

FAQs

• Complex Filter Conditions Reference (from the MonitorWare Agent Manual)
• How to create complex filter conditions

Tutorials & Samples

• Detecting Password Attacks on Windows (has filter samples)
• Remotely Monitoring IIS Log Files (has filter examples)

Related Reading

• How does the Rule Engine work?
• Online Seminar on the Rule Engine