Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to filter out some windows logs, that from program named Security-Auditing and with a message id 4624, but it doesn't work:

if $programname == 'Security-Alert' and $msgid == '4624' then /var/log/sec.log

And example of log:

Dec 30 11:49:45 Machine Security-Auditing: 4624: XX

I tried google for it, but to no avail, any thoughts?

EDIT

I tried to match against Security-Auditing with programname, syslogtag, app-name, non of those works

share|improve this question
    
In what way doesn't it work ? If you remove the $msgid clause does the $programname clause work on it's own ? –  Iain Jan 25 '13 at 10:49
    
@lain it doesn't match against it, also please see my update –  warl0ck Jan 25 '13 at 10:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.