It's been requested of me to specifically monitor for EventID 1201 out of the log Microsoft-Windows-FailoverClustering/Operational - but somehow my configuration in the SAM template just will not trigger when the EventID is present.
I suspect there's something in the name formatting that is eluding me - but dropping down the broadest settings still does not seem to pick up the EventID even when it's viewable on the server itself. The monitor simply stays green with no hits - regardless of the polling settings, time elapsed, etc.
Can someone help me and point out the (probably obvious) mistake that is being made with the configuration?
This is the latest iteration of my settings - I've also tried just log source Microsoft-Windows-FailoverClustering and just EventID 1201 with nothing else specified.
