How To Manage Monitoring Workflow When Using Windows Event Log Monitor

Question

Hi All,

I am a bit confused in the way Windows Event Log Monitor works (SAM 6.1) and how to manage monitoring workflow

1. If I monitor a log for a specific event and when it shows up - how do I retain the status of the monitor as being down/critical/warning until somebody acknowledges it, not based on time that has passed since it was detected?

2. How to utilise "Statistic Thresholds" in Windows Event Log Monitor? - there seems to be a setting already that determines status, which is "If a match is found in a polling period, component status is:". So, how do I make status Critical when event is found (not Down or based on Event)?

--

Alex

AlexSoul · Accepted Answer

OK, I am answering both of my questions

1. From description of the Component Type for the Windows Event Log Monitor (see below) it seems that it is not possible to retain status and I need an email alert to be notified in order not to miss anything

Windows Event Log Monitor

This component monitor scans Windows event logs for recent events matching your defined criteria. Events are considered recent based on the age of the event as compared to the application polling frequency. If a matching event is found, the component monitor goes to down status. The component monitor eventually returns to up status as time passes. You may not notice a matching event unless you create an alert to email you when the component goes down.

2. See below: