Configure Log Events RMM Alerts

MSP360 RMM allows you to monitor specific events in the Windows Event Log and generate alerts when matching events occur. You can use these alerts to detect unexpected shutdowns, disk errors, application failures, security events, and other issues.

Log events alerts are configured in alert profiles and can be applied to individual computers or groups of computers based on companies and tags.

Configure Alert

To configure an Log events (Windows only) alert:

1. Open RMM > Alert Profiles.
2. Create a new alert profile or edit an existing one.
3. Add a new alert and select Log events (Windows only) as the alert type.
4. Configure one or more event rules.
5. Configure the alert's post actions, if required.
6. Save the alert profile.

Configure Event Rules

Each rule specifies the Windows Event Log to monitor and the criteria used to identify matching events.

The following logs are supported:

• Application
• Security
• Setup
• System

For each rule, specify one or more of the following filters:

Field	Description
Log name	The Windows Event Log to monitor: Application, Security, Setup, or System.
Source	The application or system component that generated the event.
Event IDs	One or more event IDs to monitor.
Levels	The severity levels of events to monitor: LogAlways, Critical, Error, Warning, Information, or Verbose.

You can combine filters to narrow down the events that trigger an alert. For example:

• Specify a single event ID to monitor a particular event.
• Select a source and the Error level to monitor all errors generated by a particular application.
• Specify a log and multiple event IDs to monitor several types of events.

One alert can contain multiple rules. This allows you to monitor different event types within the same alert.

Apply the Alert Profile

You can apply an alert profile to:

• Any combination of companies and tags, with the option to exclude individual computers.
• A specific list of individual computers.

This allows you to configure different monitoring rules for different types of endpoints. For example, you can apply one profile to servers and another to workstations.

How Log Events (Windows Only) Alerts Work

The RMM Agent checks the Windows Event Log for new matching events every minute.

To prevent excessive notifications, matching events are grouped into alerts:

• An alert is raised at most once every 10 minutes.
• Multiple matching events detected during this period are grouped into one alert, which includes the total event count.
• A new alert can be raised when additional matching events are detected after the previous alert.

Log events alerts are one-time notifications, similar to Software Changes and Antivirus Activity alerts. Each alert reports events that have already occurred and closes automatically within a couple of minutes.

If an alert creates a ticket in an integrated PSA or the built-in MSP360 ticketing system, the ticket remains open until a technician reviews and closes it.

Alert Details

Each Log events (Windows only) alert provides information about the matching events, including:

• Event count – the total number of matching events.
• First event time – when the first matching event occurred.
• Event combinations – all matching combinations of log name, source, and event ID.
• Sample event details – details for up to 10 unique event IDs.

This information helps technicians identify the source of an issue and investigate it without manually searching through the Windows Event Log.

Configure Post Actions

Like other MSP360 RMM alerts, Log events alerts can trigger post actions when matching events are detected.

Available post actions include:

• Send an email notification.
• Create a ticket in ConnectWise, HaloPSA, or the built-in MSP360 ticketing system.
• Send a push notification to the MSP360 mobile app.
• Run a script selected according to the endpoint's operating system.

You can combine multiple post actions in the same alert profile to notify technicians and initiate automated responses.

Examples of Log EventMonitoring

The following examples illustrate common Log event monitoring scenarios.

Monitor Unexpected Shutdowns

Unexpected shutdowns can indicate power failures, hardware problems, or system crashes.

Configure a rule with:

• Log name: System
• Event IDs: 41, 6008

Event ID 41 (Kernel-Power) indicates that Windows restarted without shutting down properly. Event ID 6008 indicates that the previous system shutdown was unexpected.

Monitor Planned Restarts and Shutdowns

To track planned restarts and shutdowns, configure:

• Log name: System
• Event IDs: 1074

Event ID 1074 records a restart or shutdown initiated by a user or process. The event details identify the account or process responsible for the action.

Monitor Disk Errors

To detect potential disk and storage problems, configure:

• Log name: System
• Event IDs: 7, 11, 51, 153

These events can indicate disk errors, controller issues, or problems during disk I/O operations.

Monitor Third-Party Application Errors

You can monitor errors generated by applications that write events to the Windows Application log.

For example, to monitor errors from a specific application, configure:

• Log name: Application
• Source: The application's event source
• Levels: Error

You can also specify particular event IDs if you only want to monitor selected errors.

Monitor SQL Server Errors

To receive alerts for all SQL Server errors, configure:

• Log name: Application
• Source: MSSQLSERVER (or MSSQL$InstanceName for a named instance)
• Levels: Error

Leave Event IDs empty to monitor all errors generated by the specified SQL Server source.

Monitor Account Lockouts

To detect Windows account lockouts, configure:

• Log name: Security
• Event IDs: 4740
• Levels: Leave empty

Event ID 4740 indicates that a user account has been locked out.

Monitor Failed Sign-ins

To detect failed Windows sign-in attempts, configure:

• Log name: Security
• Event IDs: 4625
• Levels: Leave empty

Event ID 4625 indicates a failed account logon attempt.

Limitations

Log events (Windows only) alerts currently have the following limitations:

• Supported on Windows endpoints only.
• Only the Application, Security, Setup, and System logs are supported.
• Logs under Applications and Services Logs are not supported.
• The Audit Success and Audit Failure keywords cannot be used as filters. However, you can monitor Security log events using their event IDs.
• Alerts are triggered by any matching event. You cannot configure a minimum event count or other count-based threshold.