VMware Cloud Community
sroethlisberger
Contributor
Contributor

Regex doesn't work

Hello Everyone

Has anyone an idea how I could filter the user Logon Events(Event ID 4624) in LogInsight? (At the moment it shows me also the system accounts)

Kind regards

Steve

Labels (1)
Tags (1)
Reply
0 Kudos
1 Reply
GayathriS
Expert
Expert

Hi

I saw some thing which helps in seeing user logon details from runtime.log :

Please check below:

http://virtualkenneth.com/2017/01/10/filtering-and-auditing-within-log-insight/

Please consider marking this answer as correct and helpful if this helps you.

regards

GS

Reply
0 Kudos