Creating email alert when specific Event ID is logged in specific servers ?

Folks,

How can I create the email alerting when the specific Event ID is logged in any of my AD Domain Controllers ? Ideally, the alert is triggered after 1-hour interval of checking.

Security Group: Membership Change Event ID
4732 Added, 4733 Removed - Domain Local or Builtin Local group member
4728 Added, 4729 Removed - Global Group member
4756 Added, 4757 Removed - Universal Group member

The body of the email is the Event Logs or as an attachment where possible instead of Text message UP or DOWN.

Thanks,

Find more posts tagged with

sam

event_log

WinEvent

Accepted answers

All comments

itengineer

Any help would be greatly appreciated.

superfly

Create a new SAM template and use Windows Event Log Monitor as the component to monitor. Alert on that.

itengineer

@superfly, Does the SAM Template use one AL license per server or per Events to be monitored ?

superfly

I believe it's per component that you are monitoring. But just add one server in and look at your license count. And then add more in and see if your license count changes. I have an unlimited license so I've never worried about checking licenses.

See here for more details.

documentation.solarwinds.com/.../sam_licensing_model.htm

Tucker

thwack.solarwinds.com/.../download