646 reputation
36
bio website eventlogblog.com
location Evanston, IL
age 39
visits member for 3 years, 2 months
seen Jun 11 at 19:57

May
16
awarded  Yearling
Apr
29
comment Write to Windows Event Log when an IIS site is started or stopped
I'll see if I can adapt the script to monitor sites on 2008 as well. Also, please don't forget to upvote useful answers.
Apr
29
answered Write to Windows Event Log when an IIS site is started or stopped
Apr
3
answered Tracking memory problems
Feb
6
comment Filtering Security Logs by User and Logon Type
Interesting. Which exact setting did you end up turning on? What's a bit strange is that you were seeing other logon events, yet not the console logons. I was under the impression that they are all configured with the same setting.
Feb
5
comment Filtering Security Logs by User and Logon Type
Have you verified your audit settings in the local security policy (or domain policy if it's part of a domain) to ensure that all logons are being audited? Let me know if you need more info.
Feb
4
comment Filtering Security Logs by User and Logon Type
It looks like your query is working if you are getting results with other logon types. It's possible that you need to look at other logon types, in particular logon type 11 which is often used instead of logon type 2 on Vista and later. You can see all the logon types here: myeventlog.com/search/show/799. I bet your logons are of type 11. Let me know.
Feb
4
answered Filtering Security Logs by User and Logon Type
Nov
15
answered Windows Services: How to schedule and monitor them?
Nov
8
comment How to record IIS 8 client authentication errors in Windows Events?
One alternative to running a script would be to use a real-time log file monitoring solution to log contents from a log file (e.g. IIS log) to the event log. We develop EventSentry (eventsentry.com), and the free edition EventSentry Light does exactly that. You just configure to look for certain text patterns (e.g. 403.7), and when found it logs the entire line of the log file to the event log.
Sep
25
answered Which events in the events log should be turned into notifications for windows servers?
Jun
25
comment How Do I Change the Active DIrectory Auditing Events Maximum?
I'd be curious under which event id & source this event was logged?
May
22
comment What's this odd logon failure I see every day?
Have you checked your scheduled tasks yet? Logon type 4 is a batch logon, and most likely coming from a scheduled task (the fact it happens at the same time would also indicate that it's some sort of job). Can you post the complete event here, such as event id and any other relevant information?
May
21
answered Remote disk monitoring with WMI without admin rights
May
21
comment Remote disk monitoring with WMI without admin rights
Glad I could help, will do that now.
May
16
awarded  Yearling
May
14
comment Remote disk monitoring with WMI without admin rights
Have you checked the ACL on the root of the drive?
Apr
18
comment How can I monitor memory usage for a windows-based JVM and trigger an alert if it gets too high?
This is definitely possible, but I'd like to point out here that setting up performance counter alerts/triggers is somewhat crude, since it will trigger an alert as soon as that threshold is met, even if it just met for 10 seconds. This may work somewhat well for counters that do not change often (like memory usage), but would not work very well for more volatile counters like CPU usage. Monitoring solutions like EventSentry are a bit smarter, and let you configure the time period over which the threshold has to exceed a limit before they trigger an alert. This helps reduce false positives.
Apr
18
comment Task Scheduler just decides it doesn't want to run a task anymore
I think when Tamerz says "it", he means Windows, that is, the code that Microsoft employees wrote. I don't think he's trying to imply that the computer is self-aware, as you seem to keep suggesting. Trusting his analysis, I'd assume there is a bug, and I don't think your comments about Terminator were particularly helpful.
Apr
15
comment Event Logging for RAID fault in 2008 R2
I've written a blog article since then which outlines, step-by-step, how to go about this. eventlogblog.com/blog/2012/02/….