Need to monior a Event ID which presents in Applications and Services Eventlog.

MigrationDeletedUser over 7 years ago

Hi All,

Can anyone please help on the below request.

Need to monior a Event ID which presents in Applications and Services Eventlog.

The logs is stored locally under the following path (%SystemRoot%\System32\winevt\logs) …but this will be in a .evt format by default.

Regards

Kamal

Parents

0 MigrationDeletedUser over 7 years ago

Hi, Thanks for the solution given, but it works only for the Event log names of Security, application and system. I have attached a document where i need to configure the policy for Event ID which is present in the folder Microsoft-Windows-TerminalServices-SessionBroker which is under log name of Applications and Services. Can you please help on the same for. Regards Kamal
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 js_crc over 7 years ago in reply to MigrationDeletedUser

Hi Kamal,
You can monitor a different log by entering the name shown in the "source of" field of the event. For example, to monitor Event ID 1149 from TerminalServices Remote Connection Manager log just change the default "Event log name" value to TerminalServices-RemoteConnectionManager and the policy will go to default Windows EVT path %SystemRoot%\system32\winevt\logs where all logs under Applications and Services Logs are saved.
Hope this helps,
Regards,
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 MigrationDeletedUser over 6 years ago in reply to js_crc

Hi Advisor, I have done the policy configuration as you said Attached the screenshot of the same. Can you please check and let us know is the configuration i had is correct or not? Attached the screenshot of the policy which I have created and the event id which to be configured. Regards Kamal
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 js_crc over 6 years ago in reply to MigrationDeletedUser

Hi Kamal,
I am unable to find the attached file. Can you check and upload it again? Do you already tried deploying the policy with the "Send message if event log does not exist" option?
Looking forward to your comments,
Regards,
Juan Sobrado
OMW Technical Support Consultant
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 js_crc over 6 years ago in reply to MigrationDeletedUser

Hi Kamal,
I am unable to find the attached file. Can you check and upload it again? Do you already tried deploying the policy with the "Send message if event log does not exist" option?
Looking forward to your comments,
Regards,
Juan Sobrado
OMW Technical Support Consultant
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data

Menu

Operations Bridge

Need to monior a Event ID which presents in Applications and Services Eventlog.

Resources