I have one to share: I have an ntevl profile that we alert on a DHCP event with evt ID 1603.
But was asked to alert on all message strings that do NOT contain: NY-MGMT
The event message string comes in the format:
Microsoft-Windows-DHCP-Server (1063 - None): There are no IP addresses available for lease in the scope or superscope "NY-MGMT".
So we want to trigger the alert and generate an alarm if the string doesn't contain: NY-MGMT but for all other strings, throw the alert.
Using the nas probe's pattern/regexp validation tool (F2 when focused is set in the Message String for any Profile) 1st I tired matching the string with: /.*NY-MGMT.*/ and that matched.
Then to exclude the word "NY-MGMT"" I found that this does it:
/.*^(?!.*NY-MGMT").*/
I added the extra " at the end in case there might be machines that have a MGMT01 format. Those would still get excluded but we would want to include those an alert.
My question here is what if we wanted to use the same profile and just add another machines to the exclude list? How would that regEx look like. So if we wanted to exclude NY-MGMT and NY-BOX1 what would the expression be?