Re: Monitor specific event ID using LEM

Hey nicole,

Thanks for the info.

This is what I want to do. I need to monitor failed scheduled task in Microsoft-Windows-TaskScheduler/Operational log in 2 server .

For every error event found- 101, 311 and 202 and email alert will send.

I just accomplished this using SW log event forwarder and SW syslog but I want to try it using LEM.

I can't figure out where to start in rule creation.