A wild card is normally represented by a asterisk character (*). This denotes that any characters can replace it in that position. Each line represents an inclusion/exclusion and you can use as many patterns as you need on either side. You can also use as many wildcard characters (*) as you want per pattern to allow flexible matching against the changes being detected.
From version 188.8.131.52, user names and process names are also included in the filters if they are prefixed with a question mark (?). The same filtering rules apply with wild cards, the question mark (?) prefix indicates that the filter needs to be applied to user names and process names that are detected and not file names.
RenamesFrom version 184.108.40.206, only excludes will apply to the old file name. Previous versions would apply filters on both the old and new file name making it difficult to exclude predictably when you need to see events for excluded old file names with included new file names.
Be aware of this when using filters with renames. Excluding is strict and will apply to both the old and new file name.
ScreenshotYou can edit the include and exclude filters on the directory options screen:
ExamplesHere are some examples:
Example 1: Extensions
C:\temp\newfile.txt = match
C:\Backup\anotherfile.txt = match
C:\temp\script.bat = no match
C:\temp\doubleextension.txt.tmp = no match (to match this as well use *.txt*)
Example 2: Directories and subdirectories
C:\MonitoredDirectory\Testing\* - Will exclude/include all file and directories under the 'Testing' folder.
C:\MonitoredDirectory\doc123.txt = no match
C:\MonitoredDirectory\Testing\anything.fle = match
C:\MonitoredDirectory\Testing\SubDir\deleteme.tmp = match
Example 3: File in directories
C:\Folder\Sub\*.* - Will exclude/include all files with any extension in the directory 'Sub' which is a subdirectory of 'Folder'.
C:\Folder\new image file.bmp = no match
C:\Folder\Sub\my image.jpg = match
Example 4: Multiple wildcards
*\IgnoreDir\*.* - Will exclude/include all files inside any directory called 'IgnoreDir'.
C:\Temp\ = no match
C:\Temp\IgnoreDir\New Folder\ = no match (only file are matched when using *.*, to match everything just use *)
C:\Temp\IgnoreDir\New Folder\somefile.tmp = match
C:\*\garbage.* - Will exclude/include any files on the C: called 'garbage' with any number of extensions.
?*Jimmy* - Will exclude/include all changes made by a user called 'Jimmy'.
Machine-Name\James = no match
Jimmy@mynetwork.com = match
The same rules apply to process names.
?*scanner*.exe - Will exclude/include all changes made by process names starting with 'scanner'.
C:\Program Files\Anti-Virus\scanner.exe = match
NB: Always test your exclusions and inclusions to ensure that you are not inadvertently filtering in (or out) files that you expect to want see in the monitoring logs. Excluded files are also excluded from any further plugin processing such as emails and application execution.