can't reply for some reason on question on alerts...

Thanks for your reply, i took the suggested eventids to monitor from this website
http://manageengine.adventnet.com/products/eventlog/help/system-settings/define-eventlog-filters.html at the bottom of the page and created a manual entry. I then disabled an account and re-enabled the account to generate the events. They did show if i looked at all events in this tool but did not show up in either the SOX/HIPAA reports or the alerts that i created...

criteria is Event id
log type security
event id is 629,647,646,645,564,64001
and then i have it email two addresses that i tested successfully when i entered them in the alerting tool