I'd like monitor the following event log of my Windows Server 2019 box running Storage Spaces, but I can't see how to access it with either of the standard event log sensors:

Microsoft-Windows-StorageSpaces-Driver/Operational %SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

Can you tell me how this can be done?

Article Comments

Hello Ferd,

Right, the WMI and API sensors simply cannot get the data as it is not provided by the regarding sources. There is a custom script that should be able to achieve this.

Check also the comments in this thread, there is also being discussed how to retrieve events from a particular evtx and how to identify the necessary parameters.

Kind regards,

Erhard


May, 2019 - Permalink

Well, thanks but not really helpful.

Here's the real answer:

1. Create a key under "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog" called the name of the event log to monitor, in my example call it "Microsoft-Windows-StorageSpaces-Driver/Operational"

2. Use the PRTG WMI Eventlog sensor and it will show up

Hopefully this helps out anyone else looking to do the same.


May, 2019 - Permalink

Awesome, Ferd, you're the best.

Kind regards,

Erhard


May, 2019 - Permalink