Return
-
Title
Can Change Auditor search/alert on a specific Event ID? -
Description
Can Change Auditor search/alert on a specific Event ID? -
Resolution
Change Auditor cannot search/alert for specific event IDs, it monitors the events (at the service hook level) not by reading event logs.
You can use the Event Reference Guide PDFs included with the Documentation of Change Auditor for references on what Change Auditor can monitor:
https://support.quest.com/technical-documents/change-auditor/event-reference-guide -
Additional Information
If you need to search/alert for a specific Event ID, please consider using InTrust, which collects Windows Event Logs.