KB: Orchestrator 'Monitor Event Log' activity fires every time there is a new event, regardless of filters

Published Feb 15 2019 05:53 PM 54 Views
First published on TECHNET on Mar 19, 2013

We just published a new KB article that explains an issue where in Orchestrator 2012, the Monitor Event Log fires every time there is any new event on the specified computer regardless of filters, or if the event does not match the filters, the published data of the ‘Monitor Event Log’ activity will be empty for all the usual fields (‘Log Entry ID’, ‘Log entry description’, etc).

You can find the complete article here:

KB2821208 - Orchestrator 'Monitor Event Log' activity fires every time there is a new event, regardless of filters ( http://support.microsoft.com/kb/2821208 )

J.C. Hornbeck | Knowledge Engineer | Microsoft CTS Management and Security Division

Get the latest System Center news on Facebook and Twitter :

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

App-V Team blog: http://blogs.technet.com/appv/
MED-V Team blog: http://blogs.technet.com/medv/
Server App-V Team blog: http://blogs.technet.com/b/serverappv

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

%3CLINGO-SUB%20id%3D%22lingo-sub-347829%22%20slang%3D%22en-US%22%3EKB%3A%20Orchestrator%20'Monitor%20Event%20Log'%20activity%20fires%20every%20time%20there%20is%20a%20new%20event%2C%20regardless%20of%20filters%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-347829%22%20slang%3D%22en-US%22%3E%0A%20%26lt%3Bmeta%20http-equiv%3D%22Content-Type%22%20content%3D%22text%2Fhtml%3B%20charset%3DUTF-8%22%20%2F%26gt%3B%3CSTRONG%3E%20First%20published%20on%20TECHNET%20on%20Mar%2019%2C%202013%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%3CP%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F80238i4D9ADAF2B2FC0399%22%20%2F%3E%20We%20just%20published%20a%20new%20KB%20article%20that%20explains%20an%20issue%20where%20in%20Orchestrator%202012%2C%20the%20Monitor%20Event%20Log%20fires%20every%20time%20there%20is%20any%20new%20event%20on%20the%20specified%20computer%20regardless%20of%20filters%2C%20or%20if%20the%20event%20does%20not%20match%20the%20filters%2C%20the%20published%20data%20of%20the%20%E2%80%98Monitor%20Event%20Log%E2%80%99%20activity%20will%20be%20empty%20for%20all%20the%20usual%20fields%20(%E2%80%98Log%20Entry%20ID%E2%80%99%2C%20%E2%80%98Log%20entry%20description%E2%80%99%2C%20etc).%3C%2FP%3E%0A%20%20%3CP%3EYou%20can%20find%20the%20complete%20article%20here%3A%3C%2FP%3E%0A%20%20%3CP%3EKB2821208%20-%20Orchestrator%20'Monitor%20Event%20Log'%20activity%20fires%20every%20time%20there%20is%20a%20new%20event%2C%20regardless%20of%20filters%20(%20%3CA%20href%3D%22http%3A%2F%2Fsupport.microsoft.com%2Fkb%2F2821208%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%20http%3A%2F%2Fsupport.microsoft.com%2Fkb%2F2821208%20%3C%2FA%3E%20)%3C%2FP%3E%0A%20%20%3CP%3E%3CB%3EJ.C.%20Hornbeck%20%3C%2FB%3E%20%3CSTRONG%3E%20%7C%20Knowledge%20Engineer%20%7C%20Microsoft%20CTS%20Management%20and%20Security%20Division%3C%2FSTRONG%3E%3C%2FP%3E%0A%20%20%3CP%3E%3CB%3E%20Get%20the%20latest%20System%20Center%20news%20on%20%3C%2FB%3E%20%3CA%20href%3D%22https%3A%2F%2Fwww.facebook.com%2Fpages%2FMicrosoft-System-Center-Support%2F111513322193410%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20%3CB%3E%20Facebook%20%3C%2FB%3E%20%3C%2FA%3E%20%3CB%3E%20and%20%3C%2FB%3E%20%3CA%20href%3D%22https%3A%2F%2Ftwitter.com%2F%23!%2FMS_SystemCenter%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20%3CB%3E%20Twitter%20%3C%2FB%3E%20%3C%2FA%3E%20%3CB%3E%20%3A%20%3C%2FB%3E%3C%2FP%3E%0A%20%20%3CP%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F80239iBCA0B775B3B36B6A%22%20%2F%3E%20%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F80240iF8001E4BA3331056%22%20%2F%3E%3C%2FP%3E%0A%20%20%3CP%3ESystem%20Center%20All%20Up%3A%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fb%2Fsystemcenter%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.technet.com%2Fb%2Fsystemcenter%2F%20%3C%2FA%3E%20%3CBR%20%2F%3E%20System%20Center%20%E2%80%93%20Configuration%20Manager%20Support%20Team%20blog%3A%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fconfigurationmgr%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.technet.com%2Fconfigurationmgr%2F%20%3C%2FA%3E%20%3CBR%20%2F%3E%20System%20Center%20%E2%80%93%20Data%20Protection%20Manager%20Team%20blog%3A%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fdpm%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.technet.com%2Fdpm%2F%20%3C%2FA%3E%20%3CBR%20%2F%3E%20System%20Center%20%E2%80%93%20Orchestrator%20Support%20Team%20blog%3A%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fb%2Forchestrator%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.technet.com%2Fb%2Forchestrator%2F%20%3C%2FA%3E%20%3CBR%20%2F%3E%20System%20Center%20%E2%80%93%20Operations%20Manager%20Team%20blog%3A%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fmomteam%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.technet.com%2Fmomteam%2F%20%3C%2FA%3E%20%3CBR%20%2F%3E%20System%20Center%20%E2%80%93%20Service%20Manager%20Team%20blog%3A%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fb%2Fservicemanager%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.technet.com%2Fb%2Fservicemanager%20%3C%2FA%3E%20%3CBR%20%2F%3E%20System%20Center%20%E2%80%93%20Virtual%20Machine%20Manager%20Team%20blog%3A%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fscvmm%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.technet.com%2Fscvmm%20%3C%2FA%3E%3C%2FP%3E%0A%20%20%3CP%3EWindows%20Intune%3A%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fb%2Fwindowsintune%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.technet.com%2Fb%2Fwindowsintune%2F%20%3C%2FA%3E%20%3CBR%20%2F%3E%20WSUS%20Support%20Team%20blog%3A%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fsus%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.technet.com%2Fsus%2F%20%3C%2FA%3E%20%3CBR%20%2F%3E%20The%20AD%20RMS%20blog%3A%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fb%2Frmssupp%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.technet.com%2Fb%2Frmssupp%2F%20%3C%2FA%3E%3C%2FP%3EApp-V%20Team%20blog%3A%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fappv%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.technet.com%2Fappv%2F%20%3C%2FA%3E%20%3CBR%20%2F%3E%20MED-V%20Team%20blog%3A%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fmedv%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.technet.com%2Fmedv%2F%20%3C%2FA%3E%20%3CBR%20%2F%3E%20Server%20App-V%20Team%20blog%3A%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fb%2Fserverappv%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.technet.com%2Fb%2Fserverappv%20%3C%2FA%3E%3CP%3EThe%20Forefront%20Endpoint%20Protection%20blog%20%3A%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fb%2Fclientsecurity%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.technet.com%2Fb%2Fclientsecurity%2F%20%3C%2FA%3E%20%3CBR%20%2F%3E%20The%20Forefront%20Identity%20Manager%20blog%20%3A%20%3CA%20href%3D%22http%3A%2F%2Fblogs.msdn.com%2Fb%2Fms-identity-support%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.msdn.com%2Fb%2Fms-identity-support%2F%20%3C%2FA%3E%20%3CBR%20%2F%3E%20The%20Forefront%20TMG%20blog%3A%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fb%2Fisablog%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.technet.com%2Fb%2Fisablog%2F%20%3C%2FA%3E%20%3CBR%20%2F%3E%20The%20Forefront%20UAG%20blog%3A%20%3CA%20href%3D%22http%3A%2F%2Fblogs.technet.com%2Fb%2Fedgeaccessblog%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3E%20http%3A%2F%2Fblogs.technet.com%2Fb%2Fedgeaccessblog%2F%20%3C%2FA%3E%3C%2FP%3E%0A%20%0A%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-347829%22%20slang%3D%22en-US%22%3EFirst%20published%20on%20TECHNET%20on%20Mar%2019%2C%202013%20We%20just%20published%20a%20new%20KB%20article%20that%20explains%20an%20issue%20where%20in%20Orchestrator%202012%2C%20the%20Monitor%20Event%20Log%20fires%20every%20time%20there%20is%20any%20new%20event%20on%20the%20specified%20computer%20regardless%20of%20filters%2C%20or%20if%20the%20event%20does%20not%20match%20the%20filters%2C%20the%20published%20data%20of%20the%20%E2%80%98Monitor%20Event%20Log%E2%80%99%20activity%20will%20be%20empty%20for%20all%20the%20usual%20fields%20(%E2%80%98Log%20Entry%20ID%E2%80%99%2C%20%E2%80%98Log%20entry%20description%E2%80%99%2C%20etc).%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-347829%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ESystem%20Center%20Orchestrator%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Version history
Last update:
‎Mar 11 2019 09:49 AM
Updated by: