Collecting and Monitoring Tiered Windows Event Logs

The process is very similar to monitoring standard Windows events, however, specific details are needed to properly collect the event as the Source and Log name may differ from what it displayed in the Windows event viewer. When adding your Log and Source you must open the details of the Windows event in XML view.

Now proceed to locate the entry for Provider Name. This is the event Source name entered into your monitor. It appears similar to the following:

Now, locate the Channel entry. This is the Log name entered into the monitor. It appears similar to the following:

Once this information has been properly added, save the monitor and, if possible, use Event Create or generate the Event through other means to test the alert.

For example:

Additional Information

• Eventcreate command line reference

• Event Viewer Technet reference