This content has been marked as final. Show 5 replies
Hello again, I have gotten LEM relatively stable, but I'm having a slight issue. What I'm trying to do is setup an automatic restart/start of a closed service. For testing purposes I'm using paint, I set the correlation to processStop.eventinfo = *mspaint.exe*, this works just fine, I can see the alert fires, what the problem is I have tried setting the action to both start and restart, but it just doesn't happen. With both I have to define agent and service name, for agent I'm just selecting the detection ip, for service I have tried setting it to a text constant with a path to the filename, just the filename, and processStop.eventinfo. I can view the monitor log and see the alert firing, and it says it is taking the action I defined, but nothing happens on the pc. I double check my event logs in ndpeth and on the local pc and there's no process start anywhere in the logs, nor is there any indication that a pc setting is blocking the application from being launched. Without any kind of audit trail from the LEM console to the pc I'm not sure how to resolve this. Anyone have any ideas?