I have a Windows 7 PC that has been configured as an event collector. Subscribed events forward with no problem. However, I have attached email tasks to 17 events that I wish to be alerted on. It seems that Task Manager continuously sends multiple email alerts about the same and past event viewer tasks that I have created. I want to be emailed only once, not 10+ times for each event.
I have deleted the email alerts and recreated them, and have also tried changing the Edit Trigger "Stop task if it runs longer than 30 Minutes" and the Settings "Stop the task if it runs longer than 1 hour." I still get emails continuously. Is there any way to stop them?
As sample of one of my alerts is below:
<?xml version="1.0" encoding="UTF-16"?>
-<Task xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task" version="1.2"> -<RegistrationInfo> <Date>2012-08-14T09:27:44.4610898</Date> <Author>xxx\Administrator</Author>
<Description>4005</Description> </RegistrationInfo> -<Triggers> -<EventTrigger> <ExecutionTimeLimit>PT30M</ExecutionTimeLimit> <Enabled>true</Enabled> <Subscription><QueryList><Query Id="0"
Path="ForwardedEvents"><Select Path="ForwardedEvents">*</Select></Query></QueryList></Subscription> </EventTrigger> </Triggers> -<Principals> -<Principal id="Author"> <UserId>xxx\Administrator</UserId>
<LogonType>InteractiveToken</LogonType> <RunLevel>LeastPrivilege</RunLevel> </Principal> </Principals> -<Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
-<IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>PT1H</ExecutionTimeLimit> <Priority>7</Priority> </Settings> -<Actions Context="Author"> -<SendEmail> <Server>mail.xxx.com</Server>
<Subject>Winlogon Error 4005</Subject> <To>alerts@xxx.com</To> <From>helpdesk@xxx.com</From> <Body>The Windows logon process has unexpectedly terminated.</Body> <HeaderFields/> <Attachments/> </SendEmail>
</Actions> </Task>