Can we input multiple event-ids while creating a manual monitor and how?

We have SCOM 2012 SP1. We have created a manual monitor for a particular event-id. But, we have a situation that Trust Relationship broken alert is generating different event-ids for different servers. For Example, 7000, 7005, etc.

Do we have a procedure to include required number of event ids while creating a manual monitor/rule in a single alert. If any of the event-id meets, the same alert should generate.

September 13th, 2015 5:58am

In the event monitor --> event expression

Use OR and type different event id

Roger

  • Proposed as answer by Binoy Das 20 hours 33 minutes ago
  • Marked as answer by NarenSV 17 hours 15 minutes ago
Free Windows Admin Tool Kit Click here and download it now
September 14th, 2015 3:16am

Hi Roger,

Thanks. I was able to add multiple event-ids. If we don't have an event-id for the Healthy event, can we left it blank. Also, can we leave the Source also left blank since we have the event-id(s). Is it mandatory to provide the Event-ID and Source as well?

September 14th, 2015 9:54am

Create the monitor using the "Manual Reset" type of Windows Event monitor, this will require you to manually reset the monitor instead of automatically resetting. (you could also use the Timed Reset so that the monitor goes healthy after a specific period of time)

No, you don't need a Source for the Event ID.

Free Windows Admin Tool Kit Click here and download it now
September 14th, 2015 10:22am

Thank you for the detailed explanation :)
September 14th, 2015 10:46am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics