I am trying to alert on an specific event ID in the Microsoft\Exchange\HighAvailability\Operational log. Thus far, I have not had any luck with the syntax.
In the Template, there is a place to select the "Log to Monitor", and so I choose custom. I have tried Microsoft-Exchange-HighAvailability\Operational (the way it appears in the Event Viewer), Microsoft\Exchange\HighAvailability\Operational, Microsoft-Exchange-HighAvailability-Operational, but none return any data.
Monitoring Nested Logs using the Windows Event Log Monitor in SAM is currently not possible, but should be in the next release using the new RPC method. If you'd like to try it out yourself and report back your findings we'd love to hear your feedback. You can sign-up here to download the latest SAM 5.5 beta.