This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

How to add Event log message details in email

Hello Folks,

I have windows log monitor set up for event ID 1074 which gives me details of the server rebooting event and I am wanting to know the User who has rebooted the server. But many times what happens is, If someone from admin team rebooted it manually then we would be able to track that easily but when the server is rebooted by vCenter or patching activity tool which is BigFix or any other then we won't be able to get user information who has rebooted the server. So I have set up the monitor on event id 1074 and now able to see the 'event log message details' when I look at the monitor. I want to get this event log message detailed description in the email. How should I do that?

I have seen previous discussions on this but just for information, my trigger condition is on the application and not Component. Or else If anybody has any such thing setup to get the emails then please shed some light on this.

Thanks in advance!

4.PNG

  • Were you ever able to figure this out, I'm trying to accomplish the same thing.

  • The scope of my answer involves a manual restart on the server.  As you mentioned, you will not be given a name if it is started via VC, etc..  You'd have to setup additional alerts to search those logs. 

    Have you tried to leverage the log the alert to a file?  It does not directly email you with the information, but you could then script it to send it to you to see if that helps.  My other thought is the variable last logged in user or windows event message or alert message.  Those may give you the additional details on the EventID that gets triggered.