|
Hello, I need to monitor a handful of application directories and system32 for changes. I utilized FSChange with regex's to isolate file types to monitor. I turned this on and all of a sudden I have over 100 sources and 30 sourcetypes! Is there a way to make all of these under one source and sourcetype? It appears each individual file is a different source type as opposed to a single fschange sourcetype. Thanks for any help as there is so much its not very useful. Thanks. Kevin |
One Answer:
|
I also was pulling the whole event as I misunderstood what that did. Now I have it working and apparently there is a bug where | delete does not get rid of the source & sourcetype so I have several hundred sources and sourcetypes that I don't want... |
OK, I found the issue for the extra files I believe, it appears that in one of my whitelists I made a typo and forgot the opening bracket [.
So hopefully it is limiting its monitoring to just .exe, .dll, etc Is there a way to remove all those other sourcetypes and sources? Also, can all fschange related events be under a single source and sourcetype called fschange? Would I do this in transforms.conf?
Thanks.