Trying to setup monitor for Event ID

Question

In the TaskScheduler/operational log I'm trying to setup an alert when a specific event id doesn't get written to the log.   Essentially I'm trying to determine when a scheduled task does not complete and create an alert.   I know the Event ID/Task Category/Level, etc...that gets written for the specific job when it runs to success but I'm not sure what parameters to setup when it doesn't get written to the log for the template.  I know how to create an alert when a specific event id is written to the log just not the opposite.

Is this even possible?   Thanks in advance!!

blsanner · Answer

What do you have for a threshold further down the page?  Warning and Critical for SAM components come from the threshold settings.  My thought is that there is a threshold set for greater than zero or something like that.  I would suggest setting a threshold of less than one.

t_fuselier · Answer

Thanks for the reply.   I changed the template and it immediately went critical.   Here is the screenshot of my setup.  Could you tell me what I setup incorrectly?

blsanner · Answer

You would just set the Event Log Monitor Component such that the component is 'Up' when a match is found as follows:

Then, you can create your alert based on the application/component status as normal.