How to create an Event Condition based on the server name.

[STEVE MOORE]

I'm trying to create an Event Condition rule for monitoring a Windows event log.  The original event is 0x01169ae4.  I need to create a new event when this comes from one of our servers.  What do I need to match to the host name?  What would the configuration look like?  What I have below doesn't quite work.  I'm sure if I can figure out which part of the message I need to match I'll be able to trigger the new event.

 

 

Thanks

Steve

 

 

 

[Jason Meader]

It sounds like all you need to do is utilize the Model_Name attribute.  So in the Event Configuration gui set the Left Event Variable Type to “Attribute ID” Value of 0x1006e with an Operator of Regular Expression and the Right Event Variable Type of  String and Value of the hostname.  Then set it to generate a new event.

 

HTH

Jay

[STEVE MOORE]

That’s the information I’m looking for.  I thought I had tried using Attribute ID, but maybe it was just something I was going to try.

 

 

Thanks

Steve