Email alert when windows event ID is found

I am quite new to Solarwinds and I would like to setup an email alert that triggers when a specific event ID appears in the Windows Security Event log on a domain controller. How would I achieve this?

The domain controller are nodes configured within our Solarwinds platform.

We are currently licensed to use SAM.

The Windows event ID is 4624

Find more posts tagged with

windows event log monitor

Accepted answers

All comments

stevenstadel

Start with setting up a Windows event log monitor, then setup an email alert to trigger when that is set. Alert Documentation

iqbalf

Hi, I have the same issue and tried what you suggested above, but I couldn't figure out how to set up the alert for event ID 4624. Here is what I did:
- created a monitor with the confgs as shown in the screenshot attached:
- assigned the monitor to a node (domain controller)
- I tested the component on the assignment screen, but it gave me an error message saying Testing on a node (DC name): Failed with 'Down' status. 1501 event(s) matched the specified criteria.
- If I ignore the error and continue assigning the node and try to monitor the events, it freezes my system after a while (maybe because there are too many events in a short period).
- I had to restart my laptop and then delete the assignment.
Can someone advise further on how to set up an alert for event ID 4624 with a filter on events i.e. send email alert for the events with NTLM V1 authentication method used?
Thank you.

weston.hood

[quote userid="314849" url="~/products/solarwinds-observability-self-hosted/f/forum/104069/email-alert-when-windows-event-id-is-found/327443"]I tested the component on the assignment screen, but it gave me an error message saying Testing on a node (DC name): Failed with 'Down' status. 1501 event(s) matched the specified criteria.[/quote]

This test indicates that it worked. This is not an error. This is telling you it found 1,501 total events on that domain controller. And it sounds as though your event monitor needs for filtering since it froze your system. Try matching to keywords or regex strings; right now you have "include events" field set to disable keywords matching, try and switch to keyword matching and test using something like:

Package Name (NTLM only): NTLM V1

You can test the component against your domain controller here on this screen where you provided this screenshot. Continue testing and changing the filter until you get the desired result. Helps to have an NTLM V1 authentication in the event log so you can verify if your filters work. You truly won't know if your filters are right unless you have an example to test against (and by default its only looking 7.5 minutes back).

iqbalf

Hi Weston.Hood, Thank you for replying. The above suggestion seems to be working, as it now says 7 events found, but at the same time, it is showing that the application and component statuses are down. Can you please advise why they are showing as down and how to resolve their status?
Secondly, I need to set up an alert for this monitor. Can you please guide me on how I can use this monitor to set up email notifications/alerts?

Thank you.