event log monitor - custom log

event log monitor - custom log

i'm trying to monitor event id 25, under Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

i'm not sure i'm doing this right because it's not working
i've made a custom rule, and under file i tried both full path and event viewer file only

i've then made a new log that is like this (see attached picture)

      New to ADSelfService Plus?


                  Related Products