Filter not being applied
The filter I'm concerned with is attempting to drop logs based on the event ID.
The filter is currently setup as follows:
| Drop the Logs containing | : |
|
||
| Except | : |
|
||
| Event Source | : |
| User | : |
|
However, I am still getting logs with these event IDs. For example, 4689 - a process has terminated is still showing up all over the place. Any idea why this might be happening?
The filter is applied to the test machines we are working with. As I tried to show above, all fields are empty except for the "By event ID" field which contains a list in this format: 4689,4690,etc
Topic Participants
Nate French
Karthik Annavi
New to M365 Manager Plus?
New to M365 Manager Plus?
New to RecoveryManager Plus?
New to RecoveryManager Plus?
New to Exchange Reporter Plus?
New to Exchange Reporter Plus?
New to SharePoint Manager Plus?
New to SharePoint Manager Plus?
New to ADManager Plus?