Event Log Trigger


Triggers task execution when the monitored event is written to the Windows Event Log.

Practical Usage

Commonly used to make AutoMate act in response to system or application generated errors, warnings, successes or failures that are sent to the Windows Event Log. For example, this trigger can automatically launch a task that emails the system administrator if Windows generates a log entry stating that the DNS server could not be contacted. It can also be used to run a task when a subsequent AutoMate task logs an event to the Windows Event Log with the use of the Event Log - Write activity, which logs a user defined event to the Windows Event Log.

Related Topics  








The type of event log to monitor. The default option is Application, however, other log types can be selected by expanding the list box or a user can simply enter the log type manually.



The source of the event in which to monitor. The default option is All Sources, however, expanding the list box will show all available sources on the system to select from or a user can enter the event source manually.



The type of event to monitor. The available options are:

  • All Types (default) - All event types (listed below) will be monitored.

  • Information - An event that describes the successful operation of an application, driver, or service. For example, when a network driver loads successfully, it may be appropriate to log an Information event. Note that it is generally inappropriate for a desktop application to log an event each time it starts.

  • Warning - An event that is not necessarily significant, but may indicate a possible future problem. For example, when disk space is low, a Warning event is logged. If an application can recover from an event without loss of functionality or data, it can generally classify the event as a Warning event.

  • Error - An event that indicates a significant problem such as loss of data or loss of functionality. For example, if a service fails to load during startup, an Error event is logged.

  • Success Audit - An event that records an audited security access attempt that is successful. For example, a user's successful attempt to log on to the system is logged as a Success Audit event.

  • Failure Audit - An event that records an audited security access attempt that fails. For example, if a user tries to access a network drive and fails, the attempt is logged as a Failure Audit event.



The event category to monitor. The only available option is All categories.



Allows a description for the event to optionally be entered. To monitor for partial descriptions, use wildcard characters * or ?.





Trigger on startup if condition is true


If set to YES, the trigger will act on conditions that already exist upon startup. If set to NO (default), existing conditions are ignored. For example, the event to monitor already exists upon creation of this trigger. YES will trigger task execution, however, NO will not.

Trigger after the condition has been met 'X' times.


If enabled, specifies how many times the trigger condition must be met before the task is started. For example, if a Window trigger is set to monitor for the appearance of a Notepad window and this parameter is set to 3, the task will not launch until the third instance of Notepad appears on the desktop.

Additional Notes


When this trigger is activated, it automatically passes the AMTrigger object to the task. AMTrigger is a standard AutoMate dataset and can be used much like the datasets created by the SQL Query and Email actions. The fields of AMTrigger can be used within a task to determine specific values, such as whether or not the task was started by a trigger, which trigger started the task, when the trigger was activated and other properties. AMTrigger populates a unique set of field–value pairs for each AutoMate trigger. The following table lists the ones specific to this trigger. For more details about a specific AMTrigger field–value pair, click the associated link.


Data Type

Return Value



Returns The category of the event that activated the trigger as shown in the Windows Event Log Category parameter.



Returns the computer name where the event that activated the trigger occurred.



Returns A description of the logged event that activated the trigger.



Returns the Event ID of the logged event that activated the trigger.



Returns the source of the logged event that activated the trigger.



Returns the date/time that the monitored event was logged in the Windows Event Log.



Specifies the type of event that activated the trigger.


NOTE: A full list of AMTrigger objects exclusive to each trigger can be viewed from the Expression Builder by expanding Objects -> Triggers and selecting the desired trigger.