Quote from: farcsa on October 28, 2014, 06:38:30 PM
1:
Is there a simpler method to exclude events with predefined event id? (e.g.: 5,1006,1008,...)
not really - you can specify ID range in one rule, like <id>1001-1099</id>, but that will not help if you have non-adjacent IDs to ignore.
Quote from: farcsa on October 28, 2014, 06:38:30 PM
2:
I manage Windows 7, Windows Server 2008 and Windows Server 2012, and i see that the severity levels are the following:
Critical =1
Error=2
Warning =3
Information=4
The above example captures only Windows error level events. How to set the <level> parameter to capture Windows critical events? (And, of course, how to combine the values?)
combining codes described here: https://www.netxms.org/documentation/adminguide/log-monitoring.html#level-tag
Quote from: farcsa on October 28, 2014, 06:38:30 PM
3:
With the above parser, the agent always misses the event with event id 1. What could be the reason?
In the parser I don't see specific rule for DI 1, so it can only be caught by last rule by severity. Are you sure that severity for this event is "Error"?
Best regards,
Victor