Scheduled Task Alert Based on Event ID 322

I have a department that needs to be alerted when a scheduled task that executes every 5 minutes does not execute properly. Specifically when Event 322 occurs.

I was unfortunately not brought in until after the logs rolled and the screen shot provided didnt give any into.

I was trying to alert on last run result, and state of the task, but not knowing what the state actually is for live eventID 322 I am not sure this is the right way

I was thinking if possible to scan for the actually EVENT 322 and then alert if that shows up. I am going to see if I can write a script to look in the logs, but I wanted to ask if anyone has come up against this yet and had a better idea.

Find more posts tagged with

Alert

scheduled task

Accepted answers

All comments

marcrobinson

I think the task scheduler has events in the event log under application - then something like micosoft - windows - task scheduler. If sooo, then a sam windows event component should be able to monitor that event id. Then it is just a component alert. All of this assumes I have the path to the event logs correct...

petergwilson

https://documentation.solarwinds.com/en/success_center/sam/content/sam-windows-scheduled-task-monitor-sw2577.htm

In case you haven't seen this. I've set scheduled task monitoring up in the past for just this requirement but don't work there any more so can't look at how I did it.

adam.beedell

You can indeed scan for event 322 using a SAM event monitor template, which you should have access to if you have HCO
You probably dont need to, if you can see it as a scheduled task the sort of solutions mentioned here probably work fine.

The OOTB scheduled task monitor doesnt see into folders for some reason, if you cant see the the task check if its in a folder

How the task is written defines what you get when it fails. if you cant tell when it fails vs other times and you have access to the task, worth taking a look.

(Some people will ask you to monitor if a task fails, and program in no way for it to "fail", if so it's kinda their onus to give you a thing to look for)

Phillip.McClung

Thank you for all the great ideas on how to do this. I came up with this SAM Alert. My only question,and because I dont have a real event to check. For the custom log to monitor I have it set to Microsoft-Windows-TaskScheduler/Operational, but does it need to be maintenance? The maintenance folder has event 800 and 808 for my system. I cant find clear documentation on it either way however. All the other log for events 201, 202, 203 and so on are in the operational folder.

Phillip.McClung

Thanks for the point in the right direction. I wrote a sam alert for this. Just not sure as I dont have a real event if it should look in Microsoft-Windows-TaskScheduler/Operational or Microsoft-Windows-TaskScheduler/Maintenance.

Phillip.McClung

Great article. Thanks for pointing that out.

Phillip.McClung

Great direction. I ended up creating a sam alert. The path for the logs is Microsoft-Windows-TaskScheduler/Operational.

marcrobinson

Check the logs on the target system and look for one of the failures - you can stop looking. If not you could create a failure (copy of the task to fail and generate that id, during maintenance window or some such to limit impact - be careful, I am not advocating breaking production systems!) and that should give you the event details in the event logs, and generate the scheduled task errors to look at also.

Otherwise, monitoring the scheduled task for failures should also work as was pointed out. The scheduled task monitoring has been around for quite a while and works well. I just never had to tie the task to a specific event ID before. It was succeeded or failed on the task.