none
SCOM event ID monitoring for new task creation RRS feed

  • Question

  • I have requirement to monitor event ID: 106 in all windows servers.

    This event id will be triggered for any new task creation on any windows server. Event ID is triggered in below location.

    Microsoft-Windows-TaskScheduler/Operational

    I have a event rule to windows computer and seen that rule is pushed to one of my test windows server but still alert is not triggered in SCOM console. Any inputs ?

    Thanks,

    Ramu Chittiprolu

    Monday, October 22, 2018 12:43 PM

Answers

All replies

  • Hi,

    Can you show us your rule configuration?

    Also you haven't created an event collection rule by mistake, have you?

    Cheers


    Sam (Please take a moment to "Vote as Helpful" and/or "Mark as Answer" wherever applicable. Thanks!) Blog:AnalyticOps Insights Twitter:Sameer Mhaisekar

    Monday, October 22, 2018 1:07 PM
  • Hi Sameer,

    Please find the attached event rule configuration.

    No I haven't created event collection rule for this event id: 106.

    Thanks,

    Ramu Chittiprolu


    Monday, October 22, 2018 2:21 PM
  • Any update ?
    Monday, October 22, 2018 8:17 PM
  • Hi,

    Try with the full log name

    Microsoft-Windows-TaskScheduler/Operational

    Or you can also browse into the machine if you have access select the exact log from there.

    Cheers


    Sam (Please take a moment to "Vote as Helpful" and/or "Mark as Answer" wherever applicable. Thanks!) Blog:AnalyticOps Insights Twitter:Sameer Mhaisekar


    Monday, October 22, 2018 8:52 PM
  • Consider remove event level in your event alert rule
    Roger
    Tuesday, October 23, 2018 2:43 AM
  • Just played around with a similar issue.  The source is actually: Microsoft-Windows-TaskScheduler

    If you look in the details view of the event you will see this as the Provider Name. 

    Why make it easy when you can make it hard...


    Friday, February 14, 2020 3:50 PM