back in mom 2005 there was an alert when an agent's windows event log became corrupted. i assume because scom doesn't use used the event logs asheavily as mom, this rule/monitor was left out of scom 2007. whatever the reason, i dont' see this alert in scom. i have a machine running both agents, and scom makes no note of the system log being corrupt on that machine.
even if scom isn't using the windows logs as much, i'd still like to know if the log is corrupt on a box. am i missing anything or do i need to create a custom monitor for this? if so, any ideas as to how to just check to see if i can read a certain event log?
Hello,
There are a number of monitors for checking the event log. There are:
Unable to Process Windows Event Log
All these monitors are targeted at the Health Service class and are enabled by default. Do these cover what you after?
David