I tried creating an event log sensor to monitor DHCP logs(event logs) from my server and it was successfully connected but when I checked whether it synched or not, I just found out that it wasn't synching..
This is what i done:
match string (event message) = Scope, %, is % percent full with only % IP addressess remaining.
in another sensor i did
Filter by source = DHCP-Server
on another
Filter by ID = 1020
Have i done something wrong?
Add comment