1 Reply Latest reply on Dec 15, 2014 8:43 AM by curtisi

    Alerts on Event Viewer items

    ccg3

      Can someone direct me to an article or specific pages in the LEM user guide that will explain how to setup Event Viewer monitoring for certain events? I have been tasked with alerting a team if any Event IDs of 4098 or 4099 with a type of Warning or Errors come up. I am pretty new to this product and there is so much information it is hard to pin point where this setup informatioin is located at. If there are videos available that show this I would like to see those as well if possible.

       

      Thank you for your help with this!

       

      C

        • Re: Alerts on Event Viewer items
          curtisi

          Can you be a little more precise on what events you need?  The codes 4099 and 4098 could appear in multiple logs (System, Security, Application, etc) or from multiple applications and mean different things based on what is generating them and where they occur.

           

          Assuming you mean these:

           

          http://technet.microsoft.com/en-us/library/cc774453%28v=ws.10%29.aspx

          GPP Local Users and Groups fails with Event ID 4098 on Windows 8 and Windows Server 2012

           

          I'd suggest that you run a search like this for the 4099:

           

          2014-12-15 07_40_28-SolarWinds Log and Event Manager Console.png

           

          And like this for the 4098:

           

          2014-12-15 07_40_55-SolarWinds Log and Event Manager Console.png

           

          This is all predicated on your:

          • Having the Agent running on machines where this event has occurred in the past
          • Having the Connectors setup to capture those events (though these examples use Connectors the Windows Agent sets up by default)
          • That you're searching a time-range where the event occurred
          • That your connectors have their default Tool Aliases

           

          Once you know what the events are normalized as, building a rule to look for those precise events and send an e-mail or other alert should be pretty simple.