I have never been able to make these work in VisualCron. I can make them work in Task Scheduler. For example, I'm trying to monitor for this on my 2 domain controllers:

---

Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 10/13/2016 4:56:38 PM
Event ID: 4776
Task Category: Credential Validation
Level: Information
Keywords: Audit Failure
User: N/A
Computer: DC11.pridedallas.com
Description:
The computer attempted to validate the credentials for an account.

Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account: ANITA
Source Workstation:
Error Code: 0xC0000064

---

No matter what I try, it will not trigger on these events (and there are tons of them) happening frequently. We run the VisualCron service as an administrative user. Please don't tell me that it's the Credentials. I'm testing that now and that doesn't seem to solve the problem, but if that is the problem, do everything in our power not to have to use that box, as that means one more place we have to update credentials if we have to change that password.

1. Which version are you using now of VC?
2. Have you tried to limit to only one condition, like Application log?

---

8.2.0

2. Have you tried to limit to only one condition, like Application log?

I'm not sure what you mean.

8.2.0

2. Have you tried to limit to only one condition, like Application log?

I'm not sure what you mean.

I am talking about the settings for the Trigger. The filter you use. Anyway, we have identified some problems and will release the fixes for these in 8.2.1. Hopefully next week. I think you should test the latest beta to confirm that it is working for you.

---

8.2.0

2. Have you tried to limit to only one condition, like Application log?

I'm not sure what you mean.

I am talking about the settings for the Trigger. The filter you use. Anyway, we have identified some problems and will release the fixes for these in 8.2.1. Hopefully next week. I think you should test the latest beta to confirm that it is working for you.

I get that, but what I mean is you want me to configure it to trigger on any event in the Application Log, is that what you are saying? I don't know if I will have time to test the beta before the release.

Yes, to see which filter is causing the problem. On the other hand, the bug we have identified (and fixed) could potentially cause this problem. I would recommend that you upgrade to the beta as it is mostly bug fixes in general.

---

Still not working in 8.2.1.

So I did a test with just using the System log - that worked fine, so I added an Event ID (7036, Service status change), and it no longer works. I've noticed that in the Event ID field, that after I enable the field with "AND", add the number and then save it, when I reopen the trigger, there is a trailing space (image attached). This is the only field that does this and I can remove the space and save and when I reopen it comes back. Maybe that is the problem?

No, it should not matter. It is just preventing other characters than numbers. Moving this topic as it is in the wrong forum - hence the long delay in answer.

---

Did you already move it? What forum was it in?

Did you already move it? What forum was it in?

It was in the FAQ.

---

Any news on this issue?

We are running version 8.2.3 and are experiencing the same issue.
We have an Error event triggering on another server than the VC server.
Credentials seem to work as we can select the Log file.

Although Errors appear in the Event log, no trigger is fired.

One thing I noticed: when I logoff and login to the VC server, it fires once, but after that does not respond.

Any news on this issue?

We are running version 8.2.3 and are experiencing the same issue.
We have an Error event triggering on another server than the VC server.
Credentials seem to work as we can select the Log file.

Although Errors appear in the Event log, no trigger is fired.

One thing I noticed: when I logoff and login to the VC server, it fires once, but after that does not respond.

I tested with 8.2.4 without an issue. I am thinking it might be related to certain settings in the Trigger. For example, if you just monitor on log "Application" - do you still not see multiple updates?

---

Please test this build, we have made some changes:

http://www.visualcron.co....aspx?g=posts&t=7104 

---

Did you try the latest version?

---

These still do not work in 8.2.6.

Talking about local, remote or both?

---

Local - I haven't tried remote.

On top of the fact that this does not work, with the Event Log Trigger enabled, VisualCronService.exe is using 4-5% CPU constantly. I disable it, usage goes away. So even if we fix it, if CPU usage is going to be like that, I can't use these.

Please test this build: http://www.visualcron.co....aspx?g=posts&t=7329 

CPU usage should not be a problem. Let me know if it still is.

---

Please test this build: http://www.visualcron.co....aspx?g=posts&t=7329 

CPU usage should not be a problem. Let me know if it still is.

Yea, CPU usage issue is fixed, but the trigger is still not working. Works with "Log file" only, set but not with any other criteria (Event id, Description contains).

Please test this build: http://www.visualcron.co....aspx?g=posts&t=7329 

CPU usage should not be a problem. Let me know if it still is.

Yea, CPU usage issue is fixed, but the trigger is still not working. Works with "Log file" only, set but not with any other criteria (Event id, Description contains).

What you can do is to enable "Extended debugging" in Server settings. Then after event has been created you will see each value it compares with and the value from the event. If you see anything strange please post it here.

---

I have no idea why, but suddenly, it's working with Security and 4625, now I need to further filter it on Description, but that is not working. It appears that even though the label is "Description contains:", it's doing equal to, not contains.

I have no idea why, but suddenly, it's working with Security and 4625, now I need to further filter it on Description, but that is not working. It appears that even though the label is "Description contains:", it's doing equal to, not contains.

You are right, we will switch to Contains for the next build. Thanks!

---

So 8.2.8 is now out and I still don't see a fix for the "Contains" issue. Was it just not in the ChangeLog?