System Center operations Manager logo http://www.Oostdam.infoSystem Center Operations Manager 2007 R2 is a great product. It has some difficulties, but doesn't have any products have a problem here and there? Now this article has been made here, for several reasons. First, it is always nice to demonstrate how to get something done, secondly, I often use this, to test the functionallity en correct working of rules and alerts within System Center Operations Manager.

So enjoy! (if you did not allready knew this...)

How to manually create events (for test or fun reasons):

Open an "Elevated Command Prompt" first. For the dummies,.. thats a normal (DOS)Commandline but than with "Administrator" permissions. If you don't do this, it will not work on the recent Windows Operating Sytems, as Windows 2008 Server (R2), Vista, or Windows 7. There is a build-in command that is called "Eventcreate" that we are going to use. If you don't find/have enough information in this article, you can also type "Eventcreate /?" for detailed information on this command.

The official command line is:
EVENTCREATE [/S system [/U username [/P [password]]]] /ID eventid [/L logname] [/SO srcname] /T type /D

Let me explain the different parameters:
/S - System, stands for the system you connect to, if not specified,
       the logged on machine will be used.
/U - [domain\]user, under which name the event will be written to the log.
       If not specified, the logged on user will be used, or the name in the will be N/A.
/P - [password] which will be prompted for.
/L - Logname, the exact logname in which the event has to be created.
       (System, Security, Application, Operations Manager etc, etc,.)
/T - Type, which provides the eventtype like SUCCES, ERROR, WARNING or INFORMATION.
/SO - Source, A text, without spacing, that gives the application/program you want to fake.
/ID - Event ID, a number, officially between 1 and 1000, 
        but in many cases you can use higher numbers as well.  
/D - Description, is the text that you want to appear in the event.
       Handy if you are creating rule with text filtering in it.

Underneath you find some examples with various options.

Example for an event in the Application log:
C:\> EVENTCREATE /T WARNING /ID 1234 /L APPLICATION /D "Navision warning message 101"

Example for a ERROR in the Application log for a specific application like McAfee:
C:\> EVENTCREATE /T ERROR /ID 101 /L APPLICATION /SO McAfee /D "Agent failed to connect to ...."

And now to another (remote) server.

Example for a WARNING to the System log on SRV-EXC-001:
C:\> EVENTCREATE /S SRV-EXC-001 /T WARNING /ID 305 /L SYSTEM /D "This is not good!"

Add an ERROR to the Application log on SRV-EXC-001:
C:\> EVENTCREATE /S SRV-EXC-001 /U admin.ben /P Pa$$word /ID 301 /T ERROR /L APPLICATION /D "This is also not good!"

Have fun testing with this! The common joke is to let the junior engineer checkout Apllication event 678!

Not available.


Ben OostdamBen Oostdam has been working with Windows systems since 1993. Worked for several companies as a system administrator, and is currently a Senior Support Engineer for Qurius Customer Care in the Netherlands, specialized in System Center Solutions.

Disclaimer: The information contained in this website/article is for general information purposes only. The information is provided as is, by Ben Oostdam and while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk. In no event will we be liable for any loss or damage including without limitation, indirect or consequential loss or damage, or any loss or damage whatsoever arising from loss of data or profits arising out of, or in connection with, the use of this website. Through this website you are sometimes able to link to other websites which are not under my control. I have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them. Every effort is made to keep the website up and running smoothly. However, I take no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control. All entries in these articles, are my individual opinion, or from co-writers and they don't necessary reflect the opinion of my employer.


Friday the 7th, May 2021. All rights reserved.. // Oostdam WebDesign