In order for us to not get false positives on server health, we've had to push the monitor out to 5 min.
This is fine, but I'm trying to set up an alert/event view monitor that will show user32 event 1074 and event log 6009 events from a reboot.
After setting this up, I'm getting nothing in the console even though the events are on the server. How do event monitors handle server reboots? Is it possible the agent service is stopping before the shutdown event and after the startup event so that nothing appears in the console? or does this just sound like a config problem on the monitor?
fyi we are using SCOM 2012 SP1 UR3