Orchestrator 'Monitor Event Log' activity fires every time there is a new event, regardless of filters

You may experience one of the following issues while using System Center 2012 Orchestrator Service Pack 1 (SP1) Monitor Event Log activity:

1. Monitor Event Log fires every time there is any new event in the specified event log on the specified computer, regardless of filters on the Monitor Event Log activity.

2. If the event does not match the filters, the published data of the ‘Monitor Event Log’ activity will be empty for all the usual fields (‘Log Entry ID’, ‘Log entry description’, etc).
Microsoft is aware of this issue and is currently investigating. More information will be posted as it becomes available.
To work around this issue, put the same filter condition as in the Monitor Event Log activity in the link condition after the Monitor Event Log activity. That way, activities after Monitor Event Log will only execute if an event matching the filter occurs.

Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.

Article ID: 2821208 - Last Review: 03/19/2013 15:59:00 - Revision: 1.0

Microsoft System Center 2012 Orchestrator Service Pack 1

  • KB2821208