Applications Systems

SAM Windows Event Log Monitor does not detect Application log events (Event ID 18265)

A SAM Windows Event Log Monitor can appear not to detect Application log events even when they exist in Event Viewer because it only evaluates recent events within its polling/look-back window. Historical Application events (such as SQL Event ID 18265) that occurred before the last few polling intervals are ignored, so the component test shows “no events matched” until a new matching event is generated during the polling period.

First published date

2/25/2026 10:06 PM

Last published date

2/25/2026 10:06 PM

Overview

This article explains why a Windows Event Log Monitor component can successfully detect frequent System log events (for example, Event ID 7036) while apparently missing Application log events (such as SQL Event ID 18265), even though they are visible in Windows Event Viewer. It also shows how to validate the behavior by generating a new test event and how to tune the polling/look‑back settings so SAM reliably detects these Application events.

Product section

Server Application Monitor

Cause

This behavior is not caused by a misconfiguration of the Windows Event Log Monitor.

Windows Event Log Monitors in SAM only evaluate recent events based on the component’s polling interval, using the “Number of past polling intervals to search for events” setting to define the look‑back window.

In the reported scenario:

  • The Application log already contained historical events with Event ID 18265.

  • No new 18265 events were generated during the monitor’s polling window or during the on‑demand Test.

  • Because those historical events fell outside the configured “recent” window, the component correctly reported 0 matches, even though Event Viewer still showed older entries.

     

Resolution

To confirm and resolve the issue:

  1. Verify the Application log configuration

    • Log to Monitor: Application

    • Match Definition: Custom

    • Event ID: 18265 (or the relevant ID)

    • Event Type: Matches the event level in Event Viewer (for example, Information or Error).

    • Ensure credentials, fetching method (WMI/WinRM or RPC), and node selection are all correct.

  2. Generate a new Application event with the target Event ID

    You can manually create a test event on the monitored server using PowerShell (run as Administrator):

    Write-EventLog -LogName "Application" -Source "MSSQLSERVER" -EventID 18265 -EntryType Error -Message "Test for EventID 18265"

    Adjust -Source, -EventID, and -EntryType as needed for your environment.

  3. Retest the SAM component

    • Immediately after creating the event, click Test on the Windows Event Log Monitor component, or wait for the next scheduled polling interval.

    • The component should now:

      • Report a Statistic > 0 (at least one matching event), and

      • Change status according to your “If a match is found” setting.

  4. (Optional) Tune the look‑back window

    If your events are infrequent, consider adjusting:

    • Application polling interval (for example, every 5 minutes), and

    • Number of past polling intervals to search for events (for example, 4 to search the last 20 minutes).

    This ensures SAM evaluates an appropriate time range for “recent” events without scanning the entire log history.

PowerShell example for ticket notes

For reference, the following command successfully generated a test event that SAM detected:

Write-EventLog -LogName "Application" -Source "MSSQLSERVER" -EventID 18265 -EntryType Error -Message "Test for EventID 18265"

Related documentation