Windows Event Traps Disappearing

[Skip.Taylor]

We have the following issue and want to know if anyone has seen this. 

1) We configured a Windows Server to send traps for a given Windows Event ID.  We did this via EVNTWIN and EVNTCMD commands.

2) If we locate the Server in Spectrum One Click and click on the Events tab we can watch the events occur when the trap is sent.  Trap coming in as 0x00010801

3) If we select a different server and then go back to the original server we can see the some events but not the ones created by the Windows Event.  It seems we can see them live but not historically.

4) Additionally, I created a rule for event x00010801 to spawn a new event if certain criteria were met and these events also do not show historically.  It appears if the spawned event is configured to generate an alarm the alarm does stay however the corresponding event does not.

 

Has anyone else seen this behavior?  If so do you know of a fix? 

 

Thanks

[ackjo04]

Skip,

 

Make sure the 0x10801 event and your custom events are configured in The Event Configuration Logging "Store Event in Historical Database"

 

1. Launch the Event Configuration

2. Select the event in the Navigation panel

3. Click on the Event Options tab in the Detail panel

 

Check if the "Store Event in Historical Database" check box is checked. If not, check it, save the changes and update the event configuration.

 

Joe

[Skip.Taylor]

Perfect.  This is exactly what I needed.

Thank you.