I have configured an alert to notify me when a user is locked out of the domain, but I cannot get it to trigger. Since it is not a predefined alert, I am entering the partial text of the message (since the entire message contains the userid and machine name). The message appears in the ELA for the server as 'Other', but does the 'log message contains' field need to match the full text?