Hi all,
I would like to filter RDP accesses on some servers. It worked pretty well until I found that RDP and Citrix accesses are almost recorded the same way in the event log
- except the IP So, I read dozen of pages on regexp, but I am still not able to achieve what I want ...
I would like to filter Audit Sucess with event ID 528 - no problem there.
Plus I added the following regexp in the field "Match string (regexp)": .*Logon.*Type.*10.*(?!(127.0.0.1)).*
My understanding (which is for sure wrong as it does not work) is: keep strings where there is something, then the word "Logon", then something, then "Type", then something, then "10" then something which does not contains 127.0.0.1.
I tried as well :.*Logon.*Type.*10.*(?!(.*127.0.0.1.*)).* - Same result
Actually I would to filter all messages containing "Logon Type:10" but not "127.0.0.1".
What I got so far is all messages containing "Logon Type:10". The negative string seems to be ignored.
Any help will be appreciated
Julien.