Monitoring non default event logs

bardeev

Hi,

How I can monitoring event logs like:

Custom Log to Monitor: Microsoft-Windows-TerminalServices-SessionBroker/Admin

Log Source: TerminalServices-SessionBroker

Event ID: 802

and

Custom Log to Monitor: Microsoft-Windows-TerminalServices-SessionBroker/Operational

Log Source: TerminalServices-SessionBroker

Event ID: 2055

Events are available, but SAM not found them.

Find more posts tagged with

eventlogs

sam.

Accepted answers

All comments

rnetzel

great no response! i have a few logs i need to monitor also as Orion doesn't track Hyper-V deep enough. Logs i need to monitor for errors are....

Microsoft-Windows-Hyper-V-VMMS/Admin

Microsoft-Windows-Hyper-V-VMMS/Storage

Microsoft-Windows-Hyper-V-High-Availability/Admin

i copied the template "Windows Event Log Monitor" Application and set it up to monitor Custom Log, for example Microsoft-Windows-Hyper-V-VMMS and also tried this Microsoft-Windows-Hyper-V-VMMS/Admin and nothing seems to work. this shouldn't be so difficult to get it to work but we need the Orion Gods to chime in.

i did try putting the event log location as Microsoft-Windows-Hyper-V-VMMS-Admin also but no luck that i can tell.

rnetzel

Nothing?! come on guys. someone out there knows how to get this working.

mprobus

What have you tried so far? In looking at the options, there is a place to type the log name. Is this what you've already done?

rnetzel

yes i tried that already........"i copied the template Windows Event Log Monitor".

its probably something to do with how i reference the log name but i need someone to confirm what is needed.

rnetzel

i think i finally got it to work! really dumb but you have to change the "Fetch Method" from WMI to RPC.

i have my Custom log location set to....

Microsoft-Windows-Hyper-V-VMMS-Admin

i also set "NUMBER OF PAST POLLING INTERVALS TO SEARCH FOR EVENTS:" to 100 so it would find an Error event.

i found this in a SW article......

Monitor the Application and Service logs - SolarWinds Worldwide, LLC. Help and Support

natem50

It's not within SAM, but you could use the Solarwinds Event Log Forwarder and send items to the Solarwinds Syslog and send notifications from that. I haven't used the Event Log monitor within SAM myself.

llemieux

You're the hero we needed all along.

rnetzel

LOL thanks.

also change the "NUMBER OF PAST POLLING INTERVALS TO SEARCH FOR EVENTS:" to something better when finalizing for production use. Overall the value of 1.5 should be good regardless of the polling interval (1 minute, 5 minutes, etc). with 1.5 it will always capture everything since the last Poll.