Hi <o:p></o:p>
We have Monitoring created to monitor and alert on windows event ID 41, 109, 6008, 6009 but doesn't seems to work when these event actually raised.<o:p></o:p>
Setup and Test <o:p></o:p>
1) Monitors are disabled initially but applied overrides to enable for specific group of servers.<o:p></o:p>
2) Event Expression is set to only look at event ID.<o:p></o:p>
3) Manually generate windows event with above event ID<o:p></o:p>
- i.e. eventCreate /ID 41 /L System /SO Winplat.Net /T Error /D "This test error"<o:p></o:p>
4) SCOM successfully detects the event and sends the alert.<o:p></o:p>
We do not seems understand why above events are not being detected. <o:p></o:p>
Wondering if anyone had this issue and how they have overcome the issue. Any alternative method will be also appreciated.<o:p></o:p>