dkohler

I typed it in manually the first time. Then I saw the quotes in the example below the field, so I copied/pasted those. I'm trying anything I can think of!

mesverrum​ I verified the polling engine is set as trustedhost in the remote machines WinRM config. I have tried with, and without https. I verified the polling engine has trustedhost = *. all firewalls are off. All I've accomplished is bruises on my forehead, and dents on my desk... I ran a netstat on the remote server,…

tomiannelli​ I do have output defined later in the script. But I'm trying to get past the "can't find the file" piece. I have the winrm configured per the documentation, but the monitors appears to not be running on the remote system properly.

Full name is the same as the display name. I tested using Any Log, and it only triggers when I turn off Keyword matching. I tried with blank Keywords Matching in excluded events originally, and just again now, no joy.

Thanks Dan. works like a charm

When I use that I get Output - not defined

I've tried moving it to the root of c:, same thing.

I turned on debug logging. I looked at the log, and ran the wmi query manually. Apparently WMI is not reading the message from the event logs, that column is blank, which would explain why it matches nothing. sigh... thanks everyone for your input!

When I remove "Cannot Create Thread", it alerts on all entries with the event ID 3045 in the Ajax log. And it is under Application and Services Logs.

I have a powershell script to inject the event into the log for testing purposes.

Well, i figured out it can't see the file, but the account being used is a domain admin, so I don't know why it can't see the file. I've tried changing my script like so - $Lines = Get-Content \\${IP}\c$\windows\tracing\Trace.OLD Using "local host" execution, and a domain admin service account, as the "Credential for…

If the condition must exist for 20 minutes, why would a one time spike cause the alert to trigger? I am seeing the same thing on my on prem servers.

Dan, I noticed you were the last to edit this page on Swis powershell modules (PowerShell · solarwinds/OrionSDK Wiki · GitHub ). Are you saying that alert suppression cannot be accomplished via the powershell module and we need to use the API? I'm trying to accomplish the same thing, but keep getting "Get-SwisData : An…

Great idea, and I think that uncovered the issue. It is running on the poller, running as the machine account, even though I specified alternate credentials, and selected a different machine.

This is what I get: Message: File C:\Windows\tracing\logfile.log not found

Nope, UAC is off. WinRM is running, I configured the powershell security, per the documentation. I've tried local and remote execution, varying credentials. My mouse sighs heavily whenever I move it close to the "Test" button

Everything matches. Log name, event ID, everything. I even changed the Event Type from 'Any event' to 'information', with no luck. My monitor is configured the same as yours, for my event log. I even changed the monitor to look at the Application log, and Keyword matching does not work there either.

Added screenshot to post. Thanks for taking a look!