Need to monior a Event ID which presents in Applications and Services Eventlog.

[Kamalakannan622]

Hi All,

Can anyone please help on the below request.

Need to monior a Event ID which presents in Applications and Services Eventlog.

The logs is stored locally under the following path (%SystemRoot%\System32\winevt\logs) …but this will be in a .evt format by default.

Regards

Kamal

[js_crc]

Hi Kamal,

You can monitor  using Windows Event Log Policies. This policy is designed to read the .evt files Windows Event Viewer uses.

Right-click in the Windows Event Log branch that is in the left pane under (Policy management - Policies grouped by type - Agent Policies - Windows Event Log), then choose New - Policy. The policy editor will launch. Select the "Rules" tab and then add a new rule.

There you will have the option to choose your specific event id for the selected windows log. You can also leave it blank for the rule to evaluate any event id of the selected log.

Regards,

[Kamalakannan622]

Hi, Thanks for the solution given, but it works only for the Event log names of Security, application and system. I have attached a document where i need to configure the policy for Event ID which is present in the folder Microsoft-Windows-TerminalServices-SessionBroker which is under log name of Applications and Services. Can you please help on the same for. Regards Kamal

[js_crc]

Hi Kamal,

You can monitor a different log by entering the name shown in the "source of" field of the event. For example, to monitor Event ID 1149 from TerminalServices Remote Connection Manager log just change the default "Event log name" value to TerminalServices-RemoteConnectionManager and the policy will go to default Windows EVT path %SystemRoot%\system32\winevt\logs where all logs under Applications and Services Logs are saved.

Hope this helps,

Regards,

[Kamalakannan622]

Hi Advisor, I have done the policy configuration as you said Attached the screenshot of the same. Can you please check and let us know is the configuration i had is correct or not? Attached the screenshot of the policy which I have created and the event id which to be configured. Regards Kamal

[js_crc]

Hi Kamal,

I am unable to find the attached file. Can you check and upload it again? Do you already tried deploying the policy with the "Send message if event log does not exist" option?

Looking forward to your comments,

Regards,

Juan Sobrado

OMW Technical Support Consultant