Monitoring the Custom EventLog in OpManager

Monitoring the Custom Eventlog in OpManager.

We already support monitoring the Custom Eventlogs in OpManager.

The custom Eventlog that have multiple branches (for ex : Microsoft > Windows >TaskScheduler > Operational) doesn't report the errors to WMI class (Win32_NTLogEvent).

As OpManager relies on the WMI class "Win32_NTLogEvent" to monitor the eventlog, it is not possible to monitor the errors from these branches unless it reports to the class.

We thought it was a WMI limitation but it is actually possible. Create a key for the location in the registry. Follow the steps below to achieve this,

For ex :

Go to the registry editor --> regedit.exe --> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog --> Right Click Eventlog and create a new key "microsoft-windows-taskscheduler/operational"

Now go to Admin --> Eventlog Rules --> Add Custom EventLog (trigger some errors on the respective branch and query the device to add the log for monitoring)

Note : It is not mandatory to restart remote server or OpManager service for this configuration.