Monitor and Alert on Event ID

mrjdubb

I am setting up monitoring for the w3wp.exe service when throws an Application Error, Event ID 1000.  I have set up a monitor for that.  What I am having trouble with is creating an alert that will send an alert email (this I know how to) when the event ID occurs 10 times or more within an hour. 

I'm not sure how to set that condition.  Thoughts?

stevenwhunt

A quick way to do this would be to use a Windows PowerShell Monitor and write a PowerShell script to count the number of events with your criteria. Then you can create an alert based upon the status of the monitor. I have provided a basic script example below for reference (you will probably want to add some error checking to it). It uses your criteria and marks the component critical if 10 or more events are found. Hope this helps.

$CurrentDateTime = Get-Date;

$OldDateTime = (Get-Date).AddHours(-24);

$NumberOfEvents = (Get-EventLog -LogName "Application" -EntryType Error -Before $CurrentDateTime -After $OldDateTime | where {$_.eventID -eq 1000} | Measure-Object).Count;

Write-Host "Statistic.NumberOfEvents: $NumberOfEvents";

If ($NumberOfEvents > 9) {

    Write-Host "Message.NumberOfEvents: Number of events is $NumberOfEvents";

    Exit 3;

}

Else {

    Write-Host "Message.NumberOfEvents: Number of events is $NumberOfEvents";

    Exit 0;

}