Windows Log Monitor, match definition to include multiple keywords, is that possible?

I'm trying to differentiate between a few different Log entries, which all have the same Event ID number. I'm setting up a component monitor that has INCLUDE EVENTS WITH KEYWORDS. Is it possible to configure it to ensure all keywords are found within the Event ID that shows up in the log? This is what happens, for example, I have in the keywords field, "SAP", "Critical", "SYSAUX". I have another component monitor set up that has keywords "SAP", "Critical", SYSLOG". When just one the log entries come up, it matches the first one to the tea but the second it only matches SAP and Critical, and that monitor still ends ou up going down. End result needed...I only want the one that is down to show down so how do I or can I make it say, match all keywords if found in the log entry?

Find more posts tagged with

log_monitor

Accepted answers

aLTeReGo

Have you tried using the "SYSAUX" as optional exclusionary text in the second component monitor, and "SYSLOG" in the first so events that contain those words don't trigger a match?

Event Log Exclusion.jpg

Also, I'll assume you forgetting to open quotes on SYSLOG was a typo and it's properly entered in the component monitor of SAM.

I have another component monitor set up that has keywords "SAP", "Critical", SYSLOG".

All comments

aLTeReGo

Have you tried using the "SYSAUX" as optional exclusionary text in the second component monitor, and "SYSLOG" in the first so events that contain those words don't trigger a match?

Event Log Exclusion.jpg

Also, I'll assume you forgetting to open quotes on SYSLOG was a typo and it's properly entered in the component monitor of SAM.

I have another component monitor set up that has keywords "SAP", "Critical", SYSLOG".

crzyr3d

Yeah I made a mistake when I sent the message missing that ". I did what you suggested and it works, it just would be MUCH easier if I it would allow you to put AND in between the keywords to tell it that it has to meet all the word requirements. I greatly appreciate your suggestion. I was completely like DOH!, uh why didn't I think of that.