Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Request for assistance - Windows Event Log Monitoring

Hi, I'm new to SW. Our network team is the primary user of it at our organization. I'm on the server team and I have been asked to investigate using it for server monitoring. To that end, I'm trying to create a custom application template for monitoring the Windows event log on a server where we have installed the SW agent. The purpose is to alert someone if a certain event is not found in the event log for the past four polling cycles, which are fifteen minutes apart. I have created and applied the custom template to the server node, but there's a problem. Even though the event is in the log on the target server, SW detects that it's not.

I've attached some screenshots of the template config, the application status in SW, and evidence that the event log message does actually exist on the target server. If someone could assist me with configuring this, I would really appreciate it.

Thanks.

attachments.zip

Find more posts tagged with

Accepted answers

Petr.Vilem

Can you try to switch "Fetching method" from WMI to RPC? I am afraid that these logs are not available through WMI (not exposed under Win32_NTLogEvent WMI class).

All comments

grantallenby

You might kick yourself but....

I believe its because you need to define CMC price sync to web with ".

Eg. "CMC price sync to web"

If not let me know.

grantallenby

Also so for cleanliness it would be worth defining the event type, at the moment its set to any. I have no proof of this but mine seemed to run smoother when I set the event type.

I guess it doesn't have to then troll through loads of other types of event

FormerMember

Thanks for the idea, but that's how I originally had it configured. I removed the quotes because I thought it was being too restrictive in the search.

I have tried various permutations. I even tried telling it to search in all event logs for event ID 102 with TaskScheduler as the source and removed the keyword search entirely - it still can't find the events.

Any other suggestions would be welcome.

Thanks.

Petr.Vilem

Can you try to switch "Fetching method" from WMI to RPC? I am afraid that these logs are not available through WMI (not exposed under Win32_NTLogEvent WMI class).

Petr.Vilem

Few interesting references:
Using Windows Event Log Monitor on Deep Logs

Monitoring the Custom EventLog in OpManager

grantallenby

Is the log Name correct? I used the log path before but mine display similar to this..

%SystemRoot%\System32\Winevt\Logs\ForwardedEvents.evtx

grantallenby

Also I would add the " back in while troubleshooting. I personally found mine didn't work at all with out them.

FormerMember

Thanks for the help! Putting the keyword in quotes has the desired effect of only finding the specific events desired. RPC works where WMI does not. Those things were all tried before but failed.

What ended up making it work was removing the Source specification from the template config. Once I blanked out the source field, it tested normally.

Thanks for the references. The deep log one clued me in that a blank source can be used if you're specifying other criteria.