This monitor indicates if the Health Service was able to successfully access and open an event log to process its events. When the Health Service is unable to access an event log, there may be degradation in monitoring events out of that event log.

This can be caused by the following:

• The action account does not have the appropriate permissions to the event log indicated in the alert and monitor context.

• The event log name specified in the monitor or rule configuration does not exist on the computer where the monitor or rule is run.

• The event log name may not be typed in correctly in the monitor or rule configuration.

To resolve this issue check the following in order:

1. Take note of the rule or monitor name from the alert or monitor context. This is the text after “Workflow name” in the context.

2. Look up this name in the console and bring up the properties for that rule or monitor.

3. In the monitor or rule properties, look at the tabs that begin with “Event Log ” (for example; “Event Log (Unhealthy Event)”

4. Check that the event log name here is an event log that exists on the computer where this alert/monitor state was raised.

5. Correct this error if it is a configuration in the rule or monitor.

If the above steps do not resolve the problem, check if the action account for the Health Service has the appropriate rights on the target computer to read from that event log.