Hi!

Im trying to setup a monitor to monitor a log under "Application and Services logs".

But Scom does not seem to pickup does events?

Scom finds the log when I choose to browse after it:  "Microsoft-Exchange-HighAvailability/Seeding"

And then I can enter a eventid and a source. Although Im not sure that the source is correct. Looking in eventviewer it says "HighAvailability" as source. But looking under the xml-code it says "Microsoft-Exchange-HighAvailability" as source. I tried both and even left out the source but scom does not trigger on the event.

If I create a regular Windowsevent-monitor and point it towards application or system it works fine so there is nothing wrong with the targeting or something like that.

Has anyone been able to monitor a application and services log?

Hi,

Which class did you target the monitor to? Would you please try to target Windows Operating System Class if it does not target to that class and check the result.

We may also try to target to Windows computer class if above class does not work.

Regards,

Yan Li

Hi!
I targeted it to windows server and then disabled the rule and enabled it for a group containing the servers in question.

If I change the monitor to search for events in application or system log it works correctly with the same setup. So there must be something with the application and services log monitoring?

Hi,

Would you please try to target Windows Operating System Class?

Regards,

Yan Li

I get the same result if I target it toward the windows operating system class. No alert on events in logs from "applications and services logs" but the default application and system logs works.

I tried creating the monitor as a rule as well now with the same result. It does not trigger.

But pointing the rule or monitor against system or application logs works just fine.

I think I found the problem.

I tried to monitor for a event that occurs all the time in the log I was monitoring instead of the "total-meltdown"-event I was trying to monitor. And then it worked. It seems that Scom does not trigger on events created by new-winevent via powershell when the event is created in "application and services log". But it does trigger when you create the event in the systemlog via new-winevent. Go figure why...

• Marked as answer by Harmankardon 18 hours 26 minutes ago

I think I found the problem.

I tried to monitor for a event that occurs all the time in the log I was monitoring instead of the "total-meltdown"-event I was trying to monitor. And then it worked. It seems that Scom does not trigger on events created by new-winevent via powershell when the event is created in "application and services log". But it does trigger when you create the event in the systemlog via new-winevent. Go figure why...

• Marked as answer by Harmankardon Wednesday, June 03, 2015 12:44 PM