hi

i'm trying to monitor event id 25, under Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

i'm not sure i'm doing this right because it's not working

i've made a custom rule, and under file i tried both full path and event viewer file only

i've then made a new log that is like this (see attached picture)