Can APM alert on Event ID#s from the Application Event Log?
Gbutler, APM 3.0 turned the event log script into a self-contained component monitor named "Windows Event Log Monitor". If you're comfortable working with the script, that's fine. I just wanted to let you know about the Windows Event Log Monitor in case you weren't aware we had added one.
http://www.solarwinds.com/netperfmon/SolarWinds/OrionAPMPHComponentTypesWindowsEventLog.htm
Windows Event Log Monitor
This component monitor uses WMI communication to scan Windows Event Logs for recent events matching your defined criteria. Events are considered recent based on the age of the event as compared to the application polling frequency. If a matching event is found, the component monitor changes status.
The component monitor eventually returns to its original status as time passes so you may not notice a matching event unless you create an alert to email you when the component goes down.
I don't know if this is what you mean but there is a monitor script for windows event log that takes as arguments, event area, time frame, ID, string lookup.
We have it running every 5 minutes looking for events that will set of alerts.
Thanks - I found it and will try it out.
The selection named CUSTOM is kinda hidden and I probably would never have found it on my own.
FYI... the script broke for me due to day-light-savings... I had the monitor checking every five minutes for event IDs... it stopped working this year right at time change. I think I got the code fixed now (as much as I could figure out how MS handles time change).
