Correlated Missing Event Detection

Since it is not possible to drop more than 2 images into a forum reply I use my blog to provide the screenshot for a question there.

The original thread can be found here.

Under Authoring, Monitor, create a new unit monitor. Choose Correlated Missing Event Detection:

Enter a proper name and description and choose your target (Windows Computer would be all):

Select the event log for the event that resets your monitor back to healthy (if you’ve chosen event reset above):

Enter the event ID and the source. I took the single occurring of event ID 2 as a reset as a sample:

Choose the event log where the first event is logged:

Enter the event ID for the first event you’re expecting:

Choose the event log for the second event:

Enter the event ID for the second event you’re expecting:

Choose the correlation mode, here B must follow A within 60sec:

Select the missing event as warning and in the other as healthy (could be timer reset either):

Configure the alert settings as you’d like to see the alert in the alert views:

Cheers,
Patrick

All information is provided "as is" without any warranty! Try in lab before. Handle with care in production.