1 Reply Latest reply on Aug 28, 2015 7:48 AM by shige

    [ERC]Taskscheduler event log by WMI data source

    shige

      Hi,

       

      I want to collect Taskschedular event log of Windows by WMI data source.

      But I think that WMI data source can not collect the Taskschedular event log.

      Is my thinking correct ?

       

      OS is Windows Server 2012 R2.

      ESM is 9.5.0 MR4.

       

      Log name of Taskschedular is "Microsoft-Windows-TaskScheduler/Operational".

       

      WMI data source seems to be collected the following log type.

      - Application

      - HardwareEvents

      - Internet Explorer

      - Key Management Service

      - Security

      - System

      - Windows PowerShell

       

      I already know custom parser(ASP) can collect Taskchedular event log. ( e.x. csv format..)

      I want to know how to collect Taskschedular event log of Windows by WMI data source.

       

      Do you have a good idea ?

       

      Best Regards,

      Shige