Windows Event Log Monitor

[drenze]

I have a team that wants to receive a warning e-mail every time one of their servers restarts. Based on what I've been able to find, the easiest way to do this is to set up a Windows Event Log Monitor for Event ID 6005, which the Event log service should only generate after a reboot.

My Settings configuration is below; any fields not listed are blank:

Server: MY_SERVER

Log name: System

Event type: Information

Run alerts: For each event matched

Source and ID match: /EventLog:6005/

I've been running this against a test server and it does not pick up event 6005 from the System log, even if I leave the Source off and just run against /6005/. Help?

[kenneth.gonzale]

|s it not picking up the counter or not firing your alert? Check dashboard.

Also, remember that NTLog monitor will pick only entries newer than monitor creation time or last run time, meaning that if you create the monitor and your event was already created then it will not pick it up even on first run when you hit verify&save

[drenze · Accepted solution]

It wasn't picking up the counter.

I ended up having to change my source/ID match. I changed it to:

/EventLog[\W]+6005/i

 which matches it correctly now.

[drenze]

OK...I got the monitor to pick up the item in the log and raise a Warning after server restart. However, now I can't get it to trigger an alert based on the Warning. I've got no issues sending warning alerts for other items, but definitely for this item. Any further thoughts?

Thanks again.

[Disconnected]

Try recreating the monitor from scratch - it's probably corrupted.