Event LOG Filtering

[Guest]

I would like filter out certain events that occur very frequently and only concentrate on events that are different.

The present filtering as i understand it to list all the events that i am interested in.

what i want to do is list on the events that i am not interested in looking, so the exceptions are shown to me.

Please help
Thanks

[cmccullough]

Re: Event LOG Filtering

What you would have to do is view the events in the right window, then use the Find/Filter option under the Edit menu.

You'll enter in the event ID that you don't want to see, then select the box to Filter out records that DO match the search string.

This will remove those events from Hyena's right window leaving you all other events.

[Guest]

Re: Event LOG Filtering

Thanks it does it to some extent.
It only filters out a single event, I cannot have a list of events i want to ignore.

I was hoping to use the event log filitering as a quick check in the morning to see all that is not normal excluding the events that i choose to ignore.

P.s can the date selection field be -1 day in addition to the present seltion of fixed days.


Example:
I am not interested in all the PRINT messages, Terminal Server devices messages
Error 1111,
but see the event which i have chossen not to ignore.

I would also want to keep this selection as a template so that i can use it back at other times.

Now i can only have the last used filter in place.

if it is not possible, may be a suggestion for the next release.
Thanks
Pradeep

[cmccullough]

Re: Event LOG Filtering

The instructions from above would be the only options at this point. What you might look at is creating an Access database with a query to strip out all of the event types you don't want to see. You can then simply export the data from the right window and import it into your database. Exporter Pro can export events as well, so you might even want to use it to export them rather than waiting for the right window in Hyena.

[kstanush]

Re: Event LOG Filtering

In the next release, there will be an option to exclude/include the event IDs that are entered on the View Filtered Events dialogs.

However, you can get all of the functionality that you want now if you use WMI to get the events. By using a 'Where' query, you can specify that you want to exclude certain events and setup a filter just the way that you want to. The WMI object is under each computer. You want to use the Win32_NTLogEvent class.

[Guest]

Re: Event LOG Filtering

Thanks to both of you,
I will try both the suggestions and also await the feature in the next version.

Please also add a possibility to save the filter queries for future use.

Pradeep

[Guest]

Re: Event LOG Filtering

I thank you for incorportaing the event log filter saving feature. It is really a great help.

Now a few questions, Suggestions
1. How can i prepare a list of event filters and share it with my collegue and a comment field for some basic explations.

2. It would be useful to have a way of selecting the event filter and update the filter contents.

3. It would be useful if we can have an option to have look at only the last 24 hours button by default. Presently we have to choose the start date.

4. and finally if we can save also the list of computers on which the filiter query can be launched as an option. so that i can have a query list for the web servers and another for the file servers and not having to select them each time.

Thanks once again for the feature.
Pradeep

[kstanush]

Re: Event LOG Filtering

1. How can i prepare a list of event filters and share it with my collegue and a comment field for some basic explations.

>> There isn't any direct way to share this information, as its considered a private setting. You can use regedit to save the registry key where Hyena stores this information and someone else can load this key, but (I think) this overwrites anything that the user has at that key.

2. It would be useful to have a way of selecting the event filter and update the filter contents.

>> I'm not 100% sure what is meant by this, but we may add an option to select the event filter directly from the main Events object's menu without having to go through a couple of dialogs.

3. It would be useful if we can have an option to have look at only the last 24 hours button by default. Presently we have to choose the start date.

>> This is requested frequently, but the problem is how to implement in the GUI without causing problems.

4. and finally if we can save also the list of computers on which the filiter query can be launched as an option. so that i can have a query list for the web servers and another for the file servers and not having to select them each time.

>> There isn't any way to implement this as Hyena gets the computers from its own list independent of the filters. Your best option is to setup object groupings for the computers, or if using AD, put them into different OUs. You can then more easily select them in the right window and view the events on all of them that way.