I've got a strange thing and i'm a bit lost. I'm trying to catch the event ID 15004 - 15007 on an Exchange server to get when the server consider itself as pressured. (Application - Source : MSExchangeTransport)
I use the command :
Write-EventLog -LogName Application -EntryType Error -Source MSExchangeTransport -EventId 15006 -Message "Test error event - ignore"
to generate false event. My PRTG sensor catch it, the "state" trigger send an email... wonderful !
But, when i try to simulate a real pressure on the server (by filling one of the drive with data) : Exchange see it, raise a 15006 (Error) event... and PRTG doesn't see it.
Sensor is quite simple, just caching any events in Applications with ID 15004 to 15007 with an "include filtering", nothing else.
If i use the powershell command to raise a new one a few minutes after : PRTG "works" and send the alert.
I've tried by changing the type for my fake events (warning, info), etc... each time : PRTG catch them perfectly but never see when Exchange creates a real one. (Nothing detected, the live data graph shows nothing)
Does someone understand what's going on ?