Hello. I am currently going through the process of setting up alerts for our ELA, and one of the want items from my manager is to have an alert triggered by the spooler service crashing on a server.

Looking over the options I see in ELA along with the categories I see for a spooler service crashing event item, I see that I cannot simply use the eventID since it is 1000. We'd prefer to take a more granular approach and not have an "all application error" alert.

Is there the ability to have an alert detect what the faulting application is, and then generate an alert if it matches spoolsv.exe?

If anyone has any suggestions, or alternatives to reach this goal please let me know. Thank you!