Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

What am I doing wrong with this APM Monitor - EVENT LOG MONITOR for 'Security' events?

I'm trying to monitor and alert on a folder being accessed on the drive of a file server.

I've set up Security Audit properties for this folder and I now get the necessary events inside the Event Viewer SECURITY Log but the APM Monitor stays RED (down).

It (my new APM Application Monitor) never comes 'Up'. It just stays red.

Find more posts tagged with

Accepted answers

All comments

jeff.stewart

What happens if you change the "If a match is found in a polling period, component is:' setting?

lchance

Jeff,

I've found out this new monitor had never gone 'Up' (Green) because there were floods of these ID 560 events during each poll.

I made a couple of changes to reduce the number of events plus I made an edit for component exceptions and now it goes 'Up' (GREEN).

So it is working after all. Thanks!

borgan

What are those exceptions? I am trying to do something very similar and was having a little difficulty deciding how to make the component ever be green.

lchance

At first I only used INCLUDE EVENTS with KEYWORDS, but later on I found some other security events to cull out, so I made some using the EXCLUDE EVENTS with KEYWORDS. (My definition of exceptions.)

This is what really made the difference in my case.