I'm trying to set up a particular type of sensor logging using the WMI Event Log sensor, but I'm not sure if it's possible or not.
We have several services running on a server. The services check in every few minutes (5-15mins). Not all of them at the same frequency.
Sometimes though the service stops functioning, but still shows as running.
If the service is running correctly though, it puts an entry into the application event log with the name of the service.
So what I would like to do is create a sensor for each service and have it alert if the entry isn't present in the application log.
I can't see a way to do this though, or it might not be possible. Even if I could count the number of entries per hour or day, then trigger an alert if it doesn't meet that particular threshold. It looks to me like the volume trigger applies to the whole log rather than particular events. Or if I set the sensor to identify a string for a particular event, would the volume refer to the number of times it identifies it?