Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to filter out some windows logs, that from program named Security-Auditing and with a message id 4624, but it doesn't work:

if $programname == 'Security-Alert' and $msgid == '4624' then /var/log/sec.log

And example of log:

Dec 30 11:49:45 Machine Security-Auditing: 4624: XX

I tried google for it, but to no avail, any thoughts?


I tried to match against Security-Auditing with programname, syslogtag, app-name, non of those works

share|improve this question
In what way doesn't it work ? If you remove the $msgid clause does the $programname clause work on it's own ? – Iain Jan 25 '13 at 10:49
@lain it doesn't match against it, also please see my update – warl0ck Jan 25 '13 at 10:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.