We have a server here that we would like to receive alerts for when a user logs on or logs off. The logging on alert I have working, but the logging off part has been tricky. The easiest log with the information we need is located in Event Viewer under Applications and Services Logs -> Microsoft -> Windows. Does ELA have the ability to monitor these folders? I can't get an alert to work, and when I go to create a custom alert I don't see any options to direct ELA to this location.

Please note I am aware that Microsoft has events 4647 and 4634, but our logs do not capture those events so I'm having to look elsewhere to gather the information.

Thank you for your time.