Im trying to monitor a specific event with the icinga-for-windows PowerShell-Framework. The command im trying to use is Invoke-IcingaCheckEventlog but i cant’t get it to work propertly
The Event is Microsoft-Windows-SMBServer/Audit with ID 3000 (SMB1 access)
This is the command im using
Invoke-IcingaCheckEventlog -LogName "Microsoft-Windows-SMBServer\Audit" -IncludeEntryType Information -Verbosity 2
I tried severel different arguments (-before, -after, - IncludeEventID, etc.) without any success - it always finds 0 entries. Trying it without the -LogName argument also fails despite it schouldn’t be mandatory
In the Windows Eventlog there are plenty of entries:
Does anyone know what i am doing wrong?