cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Event Filtering (Report)

Jump to solution
Does any one know if its possible to create a report of the current Event fileting information for review
1 Solution

Accepted Solutions

Re: Event Filtering (Report)

Jump to solution

Ok I’ve added (flag) to this so we can see which is active (anything above zero)

select [EPOEventFilter].EventId, EPOEventFilterDesc.Name,[EPOEventFilter].StoreEventFlag,Flag

from [EPOEventFilter] left join [EPOEventFilterDesc] on [EPOEventFilter].[EventId]=[EPOEventFilterDesc].[EventId] where Language = '0409' order by EPOEventFilter.EventId asc

 

Now its perfect thanks for your Help

View solution in original post

6 Replies
cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 7

Re: Event Filtering (Report)

Jump to solution

What exactly are you looking for?  On any client in C:\ProgramData\McAfee\Agent you can look at the evtfiltr.ine file.  That will show you all the disabled events.  

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Event Filtering (Report)

Jump to solution

Hi

In the EPO under Server settings Event filtering there is a long list of Event ID's  (basically which alerts are being monitored)

We want to export and review this list  

aguevara
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 7

Re: Event Filtering (Report)

Jump to solution

As far as I know there is no way to create a report based on the ePO Server settings> event filtering.

I have 2 ways of doing this manually, one is to copy and paste all contents from the Server Settings>event filtering page and see it on notepad ++ or some other text editor

A cleaner option is to query directly the DB with the below statement:
----------------
select eventid, StoreEventFlag from EPOEventFilter
----------------

This will return all events IDs and their current status

0 = Store in McAfee ePO

1= Forward to syslog

2= Store in both

although it will be a good idea to have some sort of report for this, as such could you please fill a product idea?

https://kc.mcafee.com/corporate/index?page=content&id=KB60021

Regards

Alejandro

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?



Re: Event Filtering (Report)

Jump to solution

Hi

SQL query almost works great would there be any way to include the description and not just the even ID Number 

aguevara
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 7

Re: Event Filtering (Report)

Jump to solution

Try this:

-----------------

select [EPOEventFilter].EventId, EPOEventFilterDesc.Name,[EPOEventFilter].StoreEventFlag
from [EPOEventFilter] left join [EPOEventFilterDesc] on [EPOEventFilter].[EventId]=[EPOEventFilterDesc].[EventId] where Language = '0409' order by EPOEventFilter.EventId asc

---------------------------

Regards

Alejandro

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Event Filtering (Report)

Jump to solution

Ok I’ve added (flag) to this so we can see which is active (anything above zero)

select [EPOEventFilter].EventId, EPOEventFilterDesc.Name,[EPOEventFilter].StoreEventFlag,Flag

from [EPOEventFilter] left join [EPOEventFilterDesc] on [EPOEventFilter].[EventId]=[EPOEventFilterDesc].[EventId] where Language = '0409' order by EPOEventFilter.EventId asc

 

Now its perfect thanks for your Help

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community