Event Log Monitor
The Event Log Monitor can monitor one or more event logs on the system, including the standard Application, Security and System logs as well as custom event logs. You have complete flexibility in specifying which types of events are important to you and which types you'd like to ignore. In addition, you can manually add dynamic event sources (event sources that register themselves, add an event, and then unregister themselves).
The large Event Source grid shows all currently registered Event Log sources Next to each source are 6 columns listing a special Filter column, and the different event types. Place a check mark in the box of the column of event types that you're interested in. If you'd like to further filter the events by ID or by text (to either include or exclude), press the box in the Filter column.
Note: Even if you have a filter setup, you still need to have a check in at least one of the Event Type columns.
The special "=All Event Sources=" at the top of the list can be used to easily check events from all sources in a column.
Some sources register themselves with the system just long enough to add an event, and then unregister themselves, which causes them to not show up in the Event Sources list. If you want to monitor such an event source, you can press Add Event Source and manually add the name of the event source. Events that are manually entered will be shown at the top of the list and have a * added to their name. You will then be able to select which event types you'd like to monitor against that source.
If you've entered manual sources but find that you no longer need them, you can press the Clear Manual Sources button to delete your manually entered sources.
The Test Event button allows you to create an event in the event log (possibly mimicking one you're trying to target) to see if the current configuration will pick it up. After you create the event, wait a few moments for the running system to find the new event.
Note: Test events can only be created in the Application event log, and cannot be created with the Security source (only the operating system can create events with that source).
The Training option in Advanced Monitor Options is particularly useful for this monitor type. You can tell the monitor to watch a computer for a few days and automatically ignore the events that occur within that time frame (this assumes the server is healthy and behaving normally during the monitoring period). You can always go back and remove any filters that are created.
Like all monitors, this monitor has standard buttons on the right for Adding Actions, setting Advanced Monitor Options and setting the Monitor Schedule.