What is the benefit of enabling fullEvent option in fschange?

I have enabled it and it is using up a considerable part of my licence and it results only in a one line event.

example:

1-31-2012 23:51:11.547 -0500 INFO  LicenseUsage -
s="C:\WINNT\system32\wbem\Logs\FrameWork.log" st="FrameWork"
h="sim9954r01" o="" i="0433331F-43EC-4AB9-A2EA-E390ED26FC80"
pool="auto_generated_pool_enterprise" b=1905004

an example of resulting lines:

Tue Jan 31 22:47:41 2012 action=update,
path="C:\WINNT\system32\wbem\Logs\FrameWork.log", isdir=0,
size=123297095, gid=-1, uid=-1, modtime="Tue Jan 31 21:49:28 2012",
mode="rwxrwxrwx", hash=, chgs="modtime "

asked 01 Feb, 01:27

imrago
685●2●9
accept rate: 35%

edited 03 Feb, 06:39

kristian.kolb
3.4k●2●10

Be the first one to answer this question!

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

fschange ×53
fullevent ×1

Asked: 01 Feb, 01:27

Seen: 321 times

Last updated: 03 Feb, 06:39

What is the benefit of enabling fullEvent option in fschange?

Follow this question

Splunk Resources

Related questions