We use cookies to try and give you a better experience in Freshdesk.
You can learn more about what kind of cookies we use, why, and how from our Privacy policy. If you hate cookies, or are just on a diet, you can disable them altogether too. Just note that the Freshdesk service is pretty big on some cookies (we love the choco-chip ones), and some portions of Freshdesk may not work properly if you disable cookies.
We’ll also assume you agree to the way we use cookies and are ok with it as described in our Privacy policy, unless you choose to disable them altogether through your browser.
Hello,
I am a bit of a newbie at eventsentry so I am hoping I can get some assistance from this forum. I have successfully setup an SMTP relay so I am receiving notifications. I also enabled registry auditing for the folder I am looking to monitor. My issue is, I can't seem to understand how to actually setup the filter alerts. I want to track 1 registry string, the name is BOB_IDLE and its value can only be a 1 or 0. I want to know when that value has changed, and what its changed to. 1 would send me an email "Bob is idle", 2 would send me "Bob is working". As far as the application notification, I just want to know anytime a 1000 event ID "application crash" occurs. This computer basically only runs 1 application so having it send me any application crashes would be perfectly fine. I've spent the night trying to understand filters and the context field, wildcard, string etc I just can't seem to understand it. Thank you in advance for your assistance.
0 Votes
1 Comments
Ingmar Koecher posted over 3 years ago Admin
Sorry you're having trouble getting the filters & notifications to work. The process for enabling a certain email alerts, are as follows:
1. Create a new package (you can also use an existing one)
2. Assign the package to the correct host(s) / group(s) or make it global
3. Add a filter inside the package that matches the event you are looking to alert on, e.g. the "Application Error" event
4. Save the configuration. In a default setup with the collector this will ensure that the configuration is sent to remote agents as well
I would also recommend taking a look at our tutorial that explains how filters work here: https://www.eventsentry.com/support/tutorial/topic/include-exclude-filters/step/1
After enabling registry auditing, did you confirm that the audit events (https://system32.eventsentry.com/security/event/4657) were logged to the security event log?
0 Votes
Login or Sign up to post a comment