TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Hi Kris,
The info you need should be on the console's HELP somewhere.
I've cut & pasted it here for you:
Type: A numeric value referring to the type of Windows NT event log
message. Valid only for EventLog signatures. You can use the following
values:
Value Type
0 any type of event
8 success
16 failure
Category: A numeric value indicating the Windows NT Event log category
to match.Entering a 0 (zero) will match all categories. Valid only for
EventLog signatures.
Value Category
0 all categories
1 System Event
2 Logon/Logoff
3 Object Access
4 Privilege Use
5 Detailed Tracking
6 Policy Change
7 Account Management
Have fun,
Jason
>Hello,
>
>
>In Server Sensor I'm trying to come up with some user defined events. In
>particular, OS Events/NT/User Defined Events/NT EventLog Rules. When I
>create a new rule, RS is looking for Type:, Category:, and ID: fields. I
>know which fields they correspond to in NT's EventLog, but I'm not able to
>figure out what the values relate to? The ID: field I figured out, but what
>do RS values of Type and Category pair with in NT's EventLog? RS uses
>integer values whereas NT values are reported as strings. Anyone know?
>
>
>Thanks in advance,
>Kris
Jason.Renard at Mail.Com
Warning - all views expressed are my own.
I cannot guarantee the accuracy of everything
I've said - use it at your own risk.
