Event ID monitor unable to capture matched content

  • KM03220552
  • 07-Aug-2018
  • 07-Aug-2018

Archived Content: This information is no longer maintained and is provided "as is" for your convenience.

Summary

Event ID monitor unable to capture matched content. sitescope is unable to fetch no of match content details while configuring the event log monitor

Error

Event ID monitor unable to capture matched content.
sitescope is unable to fetch no of match content details while configuring the event log monitor

Fix

Customer was suggested to Changed the Source and ID match to DCOM: 10020 instead of Microsoft-Windows-DistributedCOM
I was able to monitor the error event 10020 from DistributedCOM using the follow settings.
Furthermore, I would suggest you should use EventSourceName from event details as Source name from now on.