Windows 6.x has a very powerful feature that allows specific Events to fire Scheduled Tasks.  However, one can't use it with PC Monitor Application Events because all PCM Events (or all that I know of) have an Event ID of 0.

Please give every built-in Notification a different Event ID, and display the Event IDs in the GUI.  For custom Notifications, make them user-assigned, starting at, say 1000.

This could DOUBLE the usefulness of PC Monitor...not only would we know about problems as they occur, but PCM could fix (or work around) them.

For example: I have set PC Monitor to watch CPU usage of a specific Service.  If that service exceeds 10% CPU for 3 minutes, it sends a Notification, and logs an Event.  I had wanted to have a Scheduled Task bump the Service when that Event was logged.  This would be very easy if it had a specific ID I could have Windows monitor, but it's not possible* with the current version of PCM.* Actually, it probably IS possible by crafting an XPath, and I'm attempting that now...but it's not point-and-click easy!

Until you give us a better solution, are there any XPath gurus at MMSoft, or in the community?

Web searches have mostly revealed that no one else knows how to create an Event filter, either! In particular because, in typical MS fashion, Event Viewer doesn't strictly adhere to XPath 1.0.

My biggest problem is that most of what's in [EventData] in the Event XML is what I need to be filtering on, but the current CPU utilization will always be different. So I need a "like" operator. But there isn't one. And I haven't been able to deduce what I need to do using other operators that ARE available, like "starts-with".

What I have now is attached (filter.txt). Event Viewer says the attached XPath is not valid. Don't know why, but it's also not what I really need.

I'm also attaching the edited XML of the event I'm trying to filter for (EditedEvent.txt).

EditedEvent.txt

filter.txt

You could use PC Monitor Rules for that - add a performance counter for the PCMonitorSrv process - % Processor time. As well, you can specify a list of actions when the condition is true.

Thanks; I'll look into that. Haven't explored the Rules feature and didn't realize it could do all this--sounds great!

Set it up and within minutes it had a real live test, which it passed with flying colors! Except...

1. I'm required to clear the notification before it will fire again. That is a problem. There may be Rules that should work that way, but where we're relying on PCM to intervene on our behalf, as here, the Rule needs to fire every time.

2. I still want each PCM Event in the Application log to be assigned an ID (and not all 0), for all the usability reasons that this is standard practice for events from other sources.