I'm trying to create a monitor so I can receive an alert everytime a specific user tries to successfully/failure to a server.
Under the Event Expression Tab I can enter the Event ID and the Event Source. Is this where I would specify the specific username? Do I put the username under Parameter Name / Equals / Display Name
I'm sure this is simple for you. I am new to SCOM, and am learning it all. Any help would be appreciated. Thanks in advance.