procmon-filters.conf

procmon-filters.conf

The following are the spec and example files for procmon-filters.conf.

procmon-filters.conf.spec

# Copyright (C) 2005-2010 Splunk Inc.  All Rights Reserved.  Version 4.0 
#
# This file contains potential attribute/value pairs to use when configuring Windows registry
# monitoring. The procmon-filters.conf file is used in conjunction with sysmon.conf, and 
# contains the specific regular expressions you create to refine and filter the processes
# you want Splunk to monitor. You must restart Splunk to enable configurations. 
# 
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/Aboutconfigurationfiles

[<stanza name>]
	* Name of the filter being defined.

proc = <string>
	* Regex specifying process image that you want Splunk to monitor.

type = <string>
	* Regex specifying the type(s) of process event that you want Splunk to monitor. 
        This must be a subset of those defined for the event_types attribute in regmon-filters.conf.

hive = <string>
	* Not used in this contexted, but should always have value ".*" 

procmon-filters.conf.example

# Copyright (C) 2005-2010 Splunk Inc.  All Rights Reserved.  Version 4.0 
#
# This file contains example registry monitor filters. To create your own filter, use 
# the information in procmon-filters.conf.spec.
#
# To use one or more of these configurations, copy the configuration block into
# procmon-filters.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/Aboutconfigurationfiles

[default]
hive = .*

[not-splunk-optimize]
proc = (?<!splunk-optimize.exe)$
type = create|exit|image

• Was this topic useful?
• Post a comment