iMC Syslog Email Alerts

[LindsayHill]

Cool, we'll work through it then. When you've grabbed those screenshots, we should be able to figure out the right templates that you'll need.

Enjoy the break

[Rick Johnson_6]

As far as formats go, I believe it is in the evtx format.  If there is a specific way to check, I'm unaware on how to do it.  Here are some screenshots of events from a couple of the servers I have set to forward warning and above events to IMC.  I'm attaching a Word document with two screenshots as they appear in IMC.

[LindsayHill]

OK, so I'd probably start with a couple of templates like this:

To pick up Warning Application events:

"* MSWinEventLog * Application * Warning $(Hostname) 0 $(Message)"

Warning System events:

"* MSWinEventLog * System * Warning $(Hostname) 0 $(Message)"

You can do something similar with Critical events.

[Rick Johnson_6]

Thank you very much!  I'll give that a try.  I'm sure it's a matter of getting the templates right; however, I wasn't sure of what variables to use.  I will post the results.