I'm trying to create an Event Condition rule for monitoring a Windows event log. The original event is 0x01169ae4. I need to create a new event when this comes from one of our servers. What do I need to match to the host name? What would the configuration look like? What I have below doesn't quite work. I'm sure if I can figure out which part of the message I need to match I'll be able to trigger the new event.
It sounds like all you need to do is utilize the Model_Name attribute. So in the Event Configuration gui set the Left Event Variable Type to “Attribute ID” Value of 0x1006e with an Operator of Regular Expression and the Right Event Variable Type of String and Value of the hostname. Then set it to generate a new event.
That’s the information I’m looking for. I thought I had tried using Attribute ID, but maybe it was just something I was going to try.