Quantcast
Channel: THWACK: Popular Discussions - Security Event Manager (SEM) - Formerly Log & Event Manager
Viewing all articles
Browse latest Browse all 5911

Eliminate .tmp and ~$ with filter?

$
0
0

Hi guys

 

I am trying to create a File Audit filter to show when items are created, deleted, or saved in a folder. However, I would like it to ignore .tmp files and files that are created when the file is opened (e.g. contains ~$). I have set up the filter like this so far:

 

FileDelete: Exists

FileDelete.FileName /= (does not equal) *.tmp *~$  OR

 

FileCreate: Exists

FileCreate.FileName /= (does not equal) *.tmp *~$  OR       OR (overall)

 

FileDataWrite: Exists

FileDataWrite.FileName /= (does not equal) *.tmp *~$  OR

 

This isn't working as both are still showing up. I think this is because the filter is only eliminating files that start with ~$ or .tmp. Is there a way to make it so the filter looks at the whole file name?

 

Thanks


Viewing all articles
Browse latest Browse all 5911

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>