m-g-k / eventlogmonitor Goto Github PK

Add support for -fn XXXX where XXXX is an event ID to allow filtering on specific ID numbers
Support should follow the existing Event Viewer support in allowing multiple IDs and ranges of IDs to be supported.
e.g. 10,22,100,1000-1099,-60

Examples to be supported:
Individual ID: 10
Multiple IDs are comma separated: 44,67,44
Ranges are hyphen separated: 444-555
Excluded ranges are prefixed with a hyphen: -777-888
Excluded IDs are prefixed with a hyphen: -678
All the above can be combined in any order

Only applies to the Security log, but it would be useful to see Audit Failures without the clutter of Audit Success messages.

New filter options required, such as -fas and -faf

If a message is not found in a catalogue or the catalogue itself is not found the error message is the same and this should be improved.

It would be useful to have an option to output the data as json it some situations