Troubleshooting Event Log Trigger Alerts for Applications and Services Logs

A user asked if anyone had any experience getting custom Event Viewer trigger alerts to work for applications and service logs, and whether they were able to get the process working correctly. It was suggested to ensure that the console was correctly collecting events before setting up triggers, and that the events were accessible in Powershell. The user was then referred to a ControlUp article (Real-Time Console – Events Pane [https://helpcenter.controlup.com/hc/en-us/articles/360015114517-Real-Time-Console-Events-Pane]) before it was suggested they use the "scheduled task trick" to create an event in the application.

Read the entire ‘Troubleshooting Event Log Trigger Alerts for Applications and Services Logs’ thread below:

Hello, just wanted to see if anyone in this channel has been able to get custom Event Viewer trigger alerts to work (from Applications and Service Logs). We are able to use Event Viewer triggers and get alerts for Application and System logs, but I haven’t been able to get this particular one working. I know I have the log details entered correctly, based on what’s shown in Event Viewer.

The event in question appears under Applications and Service Logs > Citrix > HostCore > ICA Service > Admin (log name on the event is Citrix-HostCore-ICA Service/Admin). I’m able to reproduce an error to generate a specific event error on the virtual desktop, but it never appears in the ControlUp Console and I never get an alert for it.

I’ve attached the following screenshots:

• Trigger filter criteria – I’ve tested this a combination of ways, being specific or broad

• New event type added in the console, but nothing gets written to it

• The Error event in question that I’m trying to generate alerts for

I appreciate any feedback or guidance anyone has. Thanks!

I would first ensure the console is collecting the events before worrying about triggers. If your connected to the agent at the time of the event you should see it in the events pane. If not then the monitor won’t either and no trigger.

It’ll only work if you can see the event log using powershell:

Else the agent won’t see the event log and won’t be able to capture events. Note that this is slated to be overhauled. For CU engineers, see VSO 163220 and 163431

Thanks, guys! When I run [System.Diagnostics.EventLog]::GetEventLogs(), I just see the same types of events as listed in the screenshot.

For reference, this is the link I was working from to attempt setting this up:

Real-Time Console – Events Pane

In the example listed, someone creates an event log in the console where the source is under Applications and Service Logs.

I just requested to have that article updated.

Did I get this right, that you can "just" configure the eventlogs shown in "System.Diagnostics.EventLog]::GetEventLogs()" on agent side within Realtime-Console?

Was there a change recently? I think back in the days it was possible to collect events!? (if they are not redirected to a persistent drive in non-persistent environments)

@member you can use the "scheduled task trick" to create an event in "Application" based on the Event in "Citrix-HostCore-ICA Service/Admin".

As far as I can tell that has always been the case. However, the way that event log are created might have been different in the past. Causing more event logs to be available.

The technology the agent uses hasn’t changed.

@member, that’s something I may test with. The particular event I’m trying to track is not widespread, but certainly still worth attempting to track and potentially take some proactive steps on. My original approach was going to use a trigger to do the following:

• Detect the event

• Delete a registry key (based on the Citrix FastTrack article about it) and optionally reboot the VDA

I appreciate your suggestion!

Continue reading and comment on the thread ‘Troubleshooting Event Log Trigger Alerts for Applications and Services Logs’.  Not a member? Join Here!