See post 1 at “SCOM custom event based rule to monitor Reboot, unexpected shutdowns and BSOD crashes”
On further testing I realised that event ID 1001 is logged on all events where a report is generated. Even on installs such as recently some Citrix servers had IE11 installed and generated this event therefore wrongly raising alerts of “Unexpected shutdown or crash”.
So I have removed event id 1001 from the rule. All for now over and out.
Advertisements
IT professional with wider interest in technology
Leave a Reply