Dear THWACKSTERS,
During a recent outage I had at my company I was trying to track Windows event logs out side the usual location below.
The Locations for custom applications was in the location below. The issue with that is that the event log browser on the node detail page will not see those. You have to create it manually.
I have attachged tghe tamplate to this post. The basic settings are below. You custom log will be different. The key is using RPC instead of WMI fetching method. Also keep in mind the polling look back setting which defaults to 1.5 polls which is about 7 minutes or so. You may want to correlate longer than that. The seocnd key is the syntax of the custom log entry. See below.
