What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general.

Learn more

PRTG Network Monitor

Intuitive to Use. Easy to manage.
More than 500,000 users rely on Paessler PRTG every day. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free Download

Top Tags

View all Tags

Event log monitoring question



I'm trying to set up a particular type of sensor logging using the WMI Event Log sensor, but I'm not sure if it's possible or not.

We have several services running on a server. The services check in every few minutes (5-15mins). Not all of them at the same frequency.

Sometimes though the service stops functioning, but still shows as running.

If the service is running correctly though, it puts an entry into the application event log with the name of the service.

So what I would like to do is create a sensor for each service and have it alert if the entry isn't present in the application log.

I can't see a way to do this though, or it might not be possible. Even if I could count the number of entries per hour or day, then trigger an alert if it doesn't meet that particular threshold. It looks to me like the volume trigger applies to the whole log rather than particular events. Or if I set the sensor to identify a string for a particular event, would the volume refer to the number of times it identifies it?

eventlog-wmi volume-trigger wmi-service

Created on Jun 28, 2019 11:53:29 AM

11 Replies



The following might be helpful:

You can configure the strings/event IDs to search for, when to go into Warning and Down state. Also, the timespan can be configured (i.e. how many hours of events shall be checked). Note that you need to configure the parameters within the script, as PRTG currently can't run parameters with special characters, such as @ or ( or ). Make sure to check our Guide for PowerShell based Custom Sensors for the installation :)

PRTGapi | Feature Requests | WMI Issues | SNMP Issues

Kind regards,
Stephan Linke, Tech Support Team

Created on Jul 1, 2019 11:30:49 AM by  Stephan Linke [Paessler Support]



Thanks, that looks like a good solution. I'll take a look as soon as I get a minute.

Created on Jul 2, 2019 9:12:34 AM



I did try that powershell script but had a lot of trouble getting it to work. I tried to keep things simple by trying to get some results from it on just the PRTG server in powershell, but can't get it to work.


.\Get-Events.ps1 -ComputerName StudySvr8 -Username administrator -Password xxxxxxxx -Channel Application -ProviderName 'Microsoft-Windows-CertificateServicesClient-AutoEnrollment' -EventID 64

Obviously I have replaced the password with X's in the above example. This produces the output :-

00:No log entries found

There are definitely entries for event 64 in the application log. I have tried it with other event ID's. Some give red error text, others just the same as the above. Some red error text, plus the No log entries found.

The only one I have managed to get to work in terms of an actual result is this :-

\Get-Events.ps1 -ComputerName StudySvr8 -Username administrator -Password xxxxxxx -Channel System -ProviderName 'Service Control Manager' -EventID 7036

This tells me :- 10:10 log entries found in the last 20 hours

Does this mean 10 with that event ID in the last 20 hours? If so, there are way more than 10 in that time period.

Running on a fully updated copy of Server 2012 R2.

Hopefully I'm making some kind of simple mistake and someone can point me in the right direction.

Created on Aug 6, 2019 4:39:57 PM



@dwinter Can you please replace line #158 with the following: { This-PrtgResult -Message ([string]::Format("Exception: $($_.Exception.Message) - Can't find anything for {0} in your {1} eventlog. Please check Log name, Provider, Log ID, EventID, ComputerName and Credentials",$ProviderName -join " or ",$Channel -join " or ")) -ExitCode 1 }

...and let me know if the entries are still disclosed as none found or if there is a special exception thrown?

Created on Aug 7, 2019 7:10:43 AM by  Stephan Linke [Paessler Support]



Line 158 was :-

if($EventList[0].Message -match "($String)"){ Write-Host $Counter":Critical event found: $($Message)"; $ExitCode = 2; return; } }

I replaced it with your suggested code above and it seems to have just broken the script.

At C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML\Get-Events.ps1:135 char:30 + function evaluateLogResults(){ + ~ Missing closing '}' in statement block. + CategoryInfo : ParserError: (:) [], ParseException + FullyQualifiedErrorId : MissingEndCurlyBrace

Created on Aug 7, 2019 9:29:33 AM



That would have been line 198 or 200? When I open up the script in an editor, line 158 is that one:


Did you leave out the comment section at the beginning when copy/pasting by any chance?

Created on Aug 8, 2019 6:27:14 AM by  Stephan Linke [Paessler Support]



I edited it in Notepad++ this time and the line was as expected, I'll give it another go. Thanks.

Created on Aug 8, 2019 8:13:06 AM



Looks like that did the trick. Thanks!

Created on Aug 8, 2019 11:14:45 AM



Did you find the actual issue? Or is it just showing the real exception now?

Created on Aug 8, 2019 12:33:56 PM by  Stephan Linke [Paessler Support]



Since replacing that line, it seems to be just working.

Created on Aug 8, 2019 12:53:53 PM



Nice! :)

Created on Aug 9, 2019 6:30:19 AM by  Stephan Linke [Paessler Support]

Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.