Hello Folks,
I have windows log monitor set up for event ID 1074 which gives me details of the server rebooting event and I am wanting to know the User who has rebooted the server. But many times what happens is, If someone from admin team rebooted it manually then we would be able to track that easily but when the server is rebooted by vCenter or patching activity tool which is BigFix or any other then we won't be able to get user information who has rebooted the server. So I have set up the monitor on event id 1074 and now able to see the 'event log message details' when I look at the monitor. I want to get this event log message detailed description in the email. How should I do that?
I have seen previous discussions on this but just for information, my trigger condition is on the application and not Component. Or else If anybody has any such thing setup to get the emails then please shed some light on this.
Thanks in advance!