The amount of warning and error events logged to the Windows application and system event logs can sometimes be overwhelming. Unfortunately, many events that are not critical errors or warnings are still logged as such to the event log(s) and will by default be forwarded to your email.
With EventSentry you can exclude events that you are not interested in receiving either from all or selected notifications through Exclude Filters. For example, you can exclude repetitive non-critical events from your email notification, but still have them forwarded to a database.
|
The default installation of EventSentry comes with a number of packages that attempt to reduce and suppress the amount of false alerts you will receive from EventSentry by email by including several filter packages with exclude filters for the most common warnings and errors (e.g. the Windows NT-2k-2k3 Server package).
The vast amount of software and event log messages logged make it extremely difficult however to offer exclusions for all non-critical events. If you did create custom exclude filters then we encourage you to export your configuration and email it to us so that we can include this information in our default filter packages. |
Creating additional Filter Packages for Exclude Filters
If the default packages do not exclude enough events, and non-important error messages are still emailed to you, then you can create one or more filter packages with custom exclusion filters.
If you only plan on adding a small amount of exclude filters (e.g. 5-10) then it is usually enough to create just one filter package. You can also use folders inside the filter package to group filters if they share common elements.
If you plan on adding a large amount of filters however (e.g. 30) then we recommend that you create multiple filter packages for your exclude filters. We generally recommend that you group your exclude filter packages based on the type of events they include. For example, you can create one filter package for your file servers, and one exclude filter package for IIS related events and then assign those two packages accordingly.
Excluding events directly from the built-in Event viewer
Instead of creating an exclude filter manually from scratch you can have EventSentry create most of the filter properties automatically for you.
Simply locate the event you would like to exclude in the built-in event viewer (if the event is on a remote computer then you will need to open the event log on the remote computer first by right-clicking the "Event Log Viewer" container), right-click the event and select "Add Exclude Filter".
When prompted, enter a name and select a package for the filter and EventSentry will create the filter in the package for you. Once the filter has been created you will need to assign a notification (if no notifications are set on a package level) and optionally move it to a different position in the package.
