I am attempting to monitor Windows event logs on a group of servers for a specific event ID. I have created an application template to monitor event logs and specified the relevant Event ID's. That part is working properly. A DOWN event is generated when this reproducible event ID is created on the nodes. However after about 5-15 minutes the node reverts back to an UP state. This is what I am trying to prevent. I would like this event to function like most others, whereby the node only returns to an UP state when the condition no longer exists. I do not want to have to manually acknowledge the alert to reset to green.
So my thought is with monitoring for an event ID, I would need a "reset trigger" to again watch for a different Event ID that would indicate the service back into UP state (monitoring just the service alone is not a valid indication of availability) itself. Would I have to create a second application template (for example "Template UP" and specify the corresponding event ID/s like I did for the down application template? One template for the down state event ID and a separate template for the UP state event ID?
I want to assign this to a group of servers but do NOT want multiple application templates showing up under the All Applications widget.
Looking for some guidance and suggestions on this one.