When creating a Windows Log Event in WhatsUp Gold v8.0x, there are four areas of configuration:
Source Type Event ID Description The first three of these work at a basic level. You can specify (say) 14130 as an Event ID but you can't specify "Not 14130" or "14130 or 14131". Only the Description allows the use of Expressions, and thus more complex config. So,if the Event ID happens to be duplicated in the Description then you should be able to construct an Expression in the way that you want. But I can't recall seeing a Windows Log entry that looked like that. So where does this leave you? 1) There is no way to construct an Event that fires when the Event ID does NOT match. 2) If you want to match against multiple Event IDs you need to create multiple Events. This, obviously, is a limitation. All I can say is "watch this space" because we are working on this. Mark Symons Ipswitch, Inc Augusta GA -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Finbom Magnus Sent: Thursday, June 03, 2004 06:23 To: '[EMAIL PROTECTED]' Subject: [WhatsUp Forum] Script expressions? Hi everyone! Im lousy on this with the expressions that you configure in the events library on the event logs. So I need some help. I created one called ALL WARNING. Source and Event ID is empty and the type is set to warning. AT first all warnings were sent to me, just as they should. Now im filtering out the ones I dont want with an expression filter. Inserted the following line: (ID:14130|Src:Print ID|Src:DhcpServer ID:1020|Src:MSExchangeSA ID:5008) And I choosed the "Doesnt contain" so that the above alerts not shoul trigger Whatsup to alert me. But in this case it does not work. For example, I still get Warning alerts with ID:14130, even though that is included in the filter. Can someone help me out? Best regards Magnus Finbom IT-Engineer(Microsoft MCP, MCP+I, MCSE-NT4) Lansforsakringar Skaraborg Bank and Insurance Radhusgatan 8 54129 Skovde Sweden phone 0500 77 70 65, gsm 0708 71 70 60, fax 0500 77 70 30 [EMAIL PROTECTED] http://www.lansforsakringar.se/skaraborg Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
