Event Log Monitor
The Event Log Monitor can monitor one or more event logs on the system, including the standard Application, Security and System logs as well as custom installed event logs. You have complete flexibility in specifying which types of events are important to you and which types you'd like to ignore. In addition, you can manually add dynamic event sources (event sources that register themselves, add an event, and then unregister themselves).
The large Event Source grid shows all currently registered sources of event log entries. Next to each source are 6 columns listing the different event types, and a special Filter column for setting event ID and text-based filters. A checked box means actions should be executed when an event of the proper type from the specified source is added to the event log. The special "=All Event Sources=" at the top of the list can be used to easily check events from all sources in a column.
Some sources of events register themselves with the system just long enough to add an event, and then unregister themselves which causes them to not show up in the Event Sources list. If you want to monitor such an event source, you can press Add Event Source and manually add the name of the event source. You will then be able to select which event types you'd like to monitor against that source.
If you've entered manual sources but find that you no longer need them, you can press the Clear Manual Sources button to delete your manually entered sources.
The Test Event button allows you to create an event in the event log (possibly mimicking one you're trying to target) to see if the current configuration will pick it up. After you create the event, wait a few moments for the running system to find the new event. One note: Test events can only be created in the Application event log.
In order to help restrict the number of actions fired to those that are truly useful, checking the "Don't activate actions for events that occurred before the current date" box will cause the monitor to ignore all events that occurred before today. This is useful if a computer is occasionally down, or if the service or monitor aren't going to run for a little while.
Event filters can be applied to further restrict which events will fire actions. Checking the box in the Event ID Filters column will display the dialog box below. Here you can enter event-source specific filters. The filters can either include or exclude events based on Event ID or text contained within the events.
Creating actions (notifications of various sorts or remedial actions like restarting a service) is done the same way as with all other monitors. Read more...