Monitor for multiple strings in Event Log monitor sensor

Modified on 2025-06-10 15:33:22 +0200

Hello, I have a sensor created to monitor the Windows event log for new events containing a certain string in the event message. What I'd like to know is, can I search for multiple message strings with the same sensor using an OR operator or something similar? Or do I need to create a separate sensor for each string I'd like to monitor for?

Thanks!

Article Comments

Attention: This article is a record of a conversation with the Paessler support team. The information in this conversation is not updated to preserve the historical record. As a result, some of the information or recommendations in this conversation might be out of date.

Hi,

Have you tried to monitor event IDs that are related to the messages you are getting in Event Viewer? Based on that approach you can combine multiple IDs in Event Log (Windows API). By using Event Log (Windows API) you can enter a comma-separated list of event IDs to add more than one ID to the filter. The list of IDs can be added under Filter Event Log Entries > Filter by ID. ?

Jul, 2020 - Permalink

Disclaimer:
The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.

Monitor for multiple strings in Event Log monitor sensor

Article CommentsAttention: This article is a record of a conversation with the Paessler support team. The information in this conversation is not updated to preserve the historical record. As a result, some of the information or recommendations in this conversation might be out of date.

Search

Attention

Related Articles

Article Comments

Attention: This article is a record of a conversation with the Paessler support team. The information in this conversation is not updated to preserve the historical record. As a result, some of the information or recommendations in this conversation might be out of date.