Jump to content
Sign in to follow this  
tvarvais

Event Log Check 'Source:' change that may affect your monitoring

Recommended Posts

Posted (edited)

FYI -    

     We recently diagnosed an issue where we were no longer getting notifications for Security Events that we had monitors setup for.  It turns out that there has been a change in the monitor that you may want to double check.  If you are specifying Source: as "Microsoft Windows security auditing" your monitor is most likely no longer functioning.  The monitor that works now requires hyphens in the entry unlike the actual 'Source' in the event log.  To get it to work again you should change the entry to: Microsoft-Windows-Security-Auditing

Hope this helps

 

Capture.PNG

Edited by tvarvais
added image
  • Like 1

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this  

×
×
  • Create New...