Applications Systems

Windows Event Log Monitor - Message is Blank

Blank Windows Event log message, custom even log message is blank in the database, and in alerting. The ${N=SwisEntity;M=ComponentAlert.WindowsEventMessages} alert variable is showing blank. Alerting is not showing event log message.

First published date

4/6/2020 5:05 PM

Last published date

12/23/2025 5:11 PM

Overview

Windows Event Log message details do not display within the web console. They also do not show when used in alerting for the variable; ${N=SwisEntity;M=ComponentAlert.WindowsEventMessages}. This variable normally populates with the details of the triggering Windows Event message. 

This is usually due to the fact that the application is unable to collect the data. This can be verified in the Orion Database, but it can more easily be confirmed if it is possible on the client-server itself. This article contains steps to confirm the event message is blank.This most often occurs on custom Event messages.

Product section

Server Application Monitor

Cause

WMI reads the message details as NULL.

Resolution

  1. Log in to the node that generated the event.
  2. Go to Start and type 'WBEMTEST' into the search box.
  3. Connect to the ROOT\CIMV2 namespace.
  4. Click 'Query' and write the following query into the window:
SELECT EventCode, Message, LogFile, RecordNumber, EventType, TimeGenerated, ComputerName, SourceName, User
FROM Win32_NTLogEvent
WHERE SourceName LIKE '%keyword%'

Note: replace "keyword" with some excerpt of your custom event message.
  1. Click Apply and wait for the results.
  2. Click 'Edit message' for one of the events as it was done on the image.
  3. Check if the message is displayed properly.
If the message is not displaying properly, Orion will not be able to poll for the message. The Windows Event Log monitor in Server & Application Monitor currently leverages WMI queries to poll for this information. You could potentially design a script monitor to query the custom event log if needed. That would be entirely custom and configured without the assistance of SolarWinds technical support.


See also: Empty message in Windows Event Log Monitor