Excessive MsiInstaller Error Events

Summary

Reports recent error events from the 'MsiInstaller' event source and lists any active Msiexec processes.

This remote monitor analyzes the Windows Application event log for error and critical events (levels 1 and 2) generated by the 'MsiInstaller' source within a specified time window (example: last 15 minutes). It summarizes these events, grouping them by event properties, and displays the most recent occurrence and message for each group. If the total number of detected events meets or exceeds a defined threshold (example: 20), the monitor also enumerates all currently running Msiexec processes and outputs their details.

The monitor is useful for troubleshooting MSI installation issues, identifying patterns of installer failures, and correlating them with active installer processes.

Note: Both the time window and threshold must be defined when creating the monitor set. These values can be configured using the @intervalMinutes and @threshold variables in the Insert SQL query.

Details

Suggested "Limit to": Msiexec Eventlog Monitoring
Suggested Alert Style: Continuous
Suggested Alert Template: △ Custom - Ticket Creation - Computer

Check Action	Server Address	Check Type	Comparator	Interval	Result
System	127.0.0.1	Run File	State Based	900	Normal State (Regex Match): `((^((OK){0,}(\r\n){0,}[\r\n]{0,}\s{0,})$)\|(^$))` Warning State: (Does Not Regex Match) `((^((OK){0,}(\r\n){0,}[\r\n]{0,}\s{0,})$)\|(^$))\|(^((\r\n){0,}[\r\n]{0,}\s{0,})Detected)` Error State (Regex Match): `^((\r\n){0,}[\r\n]{0,}\s{0,})Detected`

Target

Managed Windows Machines

EDF

Name	Level	Section	Type	Accepted Values	Description
Msiexec Eventlog Monitoring	Client	Monitoring	Dropdown	Disabled Windows Windows Server Windows Workstation	Select the operating system to enable msiexec eventlog monitoring.
Exclude Msiexec Eventlog Monitoring	Location	Exclusions	Checkbox		Flag this EDF to exclude the location from msiexec eventlog monitoring.
Exclude Msiexec Eventlog Monitoring	Computer	Exclusions	Checkbox		Flag this EDF to exclude the computer from msiexec eventlog monitoring.

Ticketing

Subject: Multiple MSI Installer Errors Detected for <ComputerName>
Ticket Body: <PowerShellResult>
Sample Result:

Detected 40 error event(s) from the 'MsiInstaller' event source within the past 15 minutes. Event log details:


Count             : 40
Eventid           : 11714
Level             : Error
Source            : MsiInstaller
LogName           : Application
MostRecentDate    : 9/22/2025 7:01:09 AM
MostRecentMessage : Product: Huntress Rio -- Error 1714. The older version of Huntress Rio cannot be removed.  Contact your
                    technical support group.  System Error 1612.




Active Msiexec process(es) currently running on this system:


Name           : msiexec.exe
ProcessId      : 1508
CommandlIne    : C:\WINDOWS\system32\msiexec.exe /V
ExecutablePath : C:\WINDOWS\system32\msiexec.exe
CreationDate   : 9/22/2025 7:20:26 AM

Implementation

Step 1

Run the provided query to create the necessary EDFs.

INSERT IGNORE INTO
    `extrafield` (
        `Form`,
        `Name`,
        `Sort`,
        `NoBreak`,
        `FType`,
        `Section`,
        `UnEditable`,
        `Collapsed`,
        `Fill`,
        `LtGuid`,
        `IsPassword`,
        `IsEncrypted`,
        `IsHidden`,
        `IsRestricted`,
        `ViewPermissions`,
        `EditPermissions`
    )
VALUES (
        3,
        'Msiexec Eventlog Monitoring',
        1,
        0,
        2,
        'Monitoring',
        0,
        0,
        'Disabled~Windows~Windows Server~Windows Workstation|Select the operating system to enable msiexec eventlog monitoring|',
        '3f77d017-1375-4bd6-b1d1-bc9374a30958',
        0,
        0,
        0,
        0,
        '',
        ''
    ),
    (
        2,
        'Exclude Msiexec Eventlog Monitoring',
        0,
        0,
        1,
        'Exclusions',
        0,
        0,
        '|Flag this EDF to exclude the location from msiexec eventlog monitoring|',
        'ac2227dd-0831-4349-a0fb-be75253f727e',
        0,
        0,
        0,
        0,
        '',
        ''
    ),
    (
        1,
        'Exclude Msiexec Eventlog Monitoring',
        0,
        0,
        1,
        'Exclusions',
        0,
        0,
        '|Flag this EDF to exclude the machine from msiexec eventlog monitoring|',
        '2f55ffe3-0830-4b46-8303-8f969e0f6228',
        0,
        0,
        0,
        0,
        '',
        ''
    );

CALL v_extradata (3, 'clients');

CALL v_extradata (2, 'locations');

CALL v_extradata (1, 'computers');

Step 2

Run the next query to create the Msiexec Eventlog Monitoring search.

INSERT INTO `sensorchecks` 
SELECT 
'' as `SensID`,
'Msiexec Eventlog Monitoring'  as `Name`, 
'SELECT \r\n   computers.computerid as `Computer Id`,\r\n   computers.name as `Computer Name`,\r\n   clients.name as `Client Name`,\r\n   computers.domain as `Computer Domain`,\r\n   computers.username as `Computer User`,\r\n   IFNULL(IFNULL(edfAssigned1.Value,edfDefault1.value),\'0\') as `Computer - Location - Extra Data Field - Exclusions - Exclude Msiexec Eventlog Monitoring`,\r\n   IFNULL(IFNULL(edfAssigned2.Value,edfDefault2.value),\'0\') as `Computer - Extra Data Field - Exclusion - Exclude Msiexec Eventlog Monitoring`,\r\n   IF(INSTR(IFNULL(inv_operatingsystem.Name, Computers.OS), \'windows\')>0, 1, IF(INSTR(IFNULL(inv_operatingsystem.Name, Computers.OS), \'darwin\') >0, 2, 3)) as `Computer.OS.Type`,\r\n   inv_operatingsystem.Server as `Computer.OS.IsServer`,\r\n   IFNULL(IFNULL(edfAssigned3.Value,edfDefault3.value),\'\') as `Computer - Client - Extra Data Field - Monitoring - Msiexec Eventlog Monitoring`,\r\n   IFNULL(IFNULL(edfAssigned4.Value,edfDefault4.value),\'\') as `Computer - Client - Extra Data Field - Monitoring - Msiexec Eventlog Monitoring`,\r\n   IFNULL(IFNULL(edfAssigned5.Value,edfDefault5.value),\'\') as `Computer - Client - Extra Data Field - Monitoring - Msiexec Eventlog Monitoring`,\r\n   IFNULL(IFNULL(edfAssigned6.Value,edfDefault6.value),\'\') as `Computer - Client - Extra Data Field - Monitoring - Msiexec Eventlog Monitoring`\r\nFROM Computers \r\nLEFT JOIN inv_operatingsystem ON (Computers.ComputerId=inv_operatingsystem.ComputerId)\r\nLEFT JOIN Clients ON (Computers.ClientId=Clients.ClientId)\r\nLEFT JOIN Locations ON (Computers.LocationId=Locations.LocationID)\r\nLEFT JOIN ExtraFieldData edfAssigned1 ON (edfAssigned1.id=Locations.LocationId and edfAssigned1.ExtraFieldId =(Select ExtraField.id FROM ExtraField WHERE LTGuid=\'ac2227dd-0831-4349-a0fb-be75253f727e\'))\r\nLEFT JOIN ExtraFieldData edfDefault1 ON (edfDefault1.id=0 and edfDefault1.ExtraFieldId =(Select ExtraField.id FROM ExtraField WHERE LTGuid=\'ac2227dd-0831-4349-a0fb-be75253f727e\'))\r\nLEFT JOIN ExtraFieldData edfAssigned2 ON (edfAssigned2.id=Computers.ComputerId and edfAssigned2.ExtraFieldId =(Select ExtraField.id FROM ExtraField WHERE LTGuid=\'2f55ffe3-0830-4b46-8303-8f969e0f6228\'))\r\nLEFT JOIN ExtraFieldData edfDefault2 ON (edfDefault2.id=0 and edfDefault2.ExtraFieldId =(Select ExtraField.id FROM ExtraField WHERE LTGuid=\'2f55ffe3-0830-4b46-8303-8f969e0f6228\'))\r\nLEFT JOIN ExtraFieldData edfAssigned3 ON (edfAssigned3.id=Clients.ClientId and edfAssigned3.ExtraFieldId =(Select ExtraField.id FROM ExtraField WHERE LTGuid=\'3f77d017-1375-4bd6-b1d1-bc9374a30958\'))\r\nLEFT JOIN ExtraFieldData edfDefault3 ON (edfDefault3.id=0 and edfDefault3.ExtraFieldId =(Select ExtraField.id FROM ExtraField WHERE LTGuid=\'3f77d017-1375-4bd6-b1d1-bc9374a30958\'))\r\nLEFT JOIN ExtraFieldData edfAssigned4 ON (edfAssigned4.id=Clients.ClientId and edfAssigned4.ExtraFieldId =(Select ExtraField.id FROM ExtraField WHERE LTGuid=\'3f77d017-1375-4bd6-b1d1-bc9374a30958\'))\r\nLEFT JOIN ExtraFieldData edfDefault4 ON (edfDefault4.id=0 and edfDefault4.ExtraFieldId =(Select ExtraField.id FROM ExtraField WHERE LTGuid=\'3f77d017-1375-4bd6-b1d1-bc9374a30958\'))\r\nLEFT JOIN ExtraFieldData edfAssigned5 ON (edfAssigned5.id=Clients.ClientId and edfAssigned5.ExtraFieldId =(Select ExtraField.id FROM ExtraField WHERE LTGuid=\'3f77d017-1375-4bd6-b1d1-bc9374a30958\'))\r\nLEFT JOIN ExtraFieldData edfDefault5 ON (edfDefault5.id=0 and edfDefault5.ExtraFieldId =(Select ExtraField.id FROM ExtraField WHERE LTGuid=\'3f77d017-1375-4bd6-b1d1-bc9374a30958\'))\r\nLEFT JOIN ExtraFieldData edfAssigned6 ON (edfAssigned6.id=Clients.ClientId and edfAssigned6.ExtraFieldId =(Select ExtraField.id FROM ExtraField WHERE LTGuid=\'3f77d017-1375-4bd6-b1d1-bc9374a30958\'))\r\nLEFT JOIN ExtraFieldData edfDefault6 ON (edfDefault6.id=0 and edfDefault6.ExtraFieldId =(Select ExtraField.id FROM ExtraField WHERE LTGuid=\'3f77d017-1375-4bd6-b1d1-bc9374a30958\'))\r\n WHERE \r\n((((IFNULL(IFNULL(edfAssigned1.Value,edfDefault1.value),\'0\')=0) AND (IFNULL(IFNULL(edfAssigned2.Value,edfDefault2.value),\'0\')=0) AND (IF(INSTR(IFNULL(inv_operatingsystem.Name, Computers.OS), \'windows\')>0, 1, IF(INSTR(IFNULL(inv_operatingsystem.Name, Computers.OS), \'darwin\') >0, 2, 3)) = \'1\') AND (((((inv_operatingsystem.Server<>0) AND (((IFNULL(IFNULL(edfAssigned3.Value,edfDefault3.value),\'\') = \'Windows\') OR (IFNULL(IFNULL(edfAssigned4.Value,edfDefault4.value),\'\') = \'Windows Server\'))))) OR (((inv_operatingsystem.Server=0) AND (((IFNULL(IFNULL(edfAssigned5.Value,edfDefault5.value),\'\') = \'Windows\') OR (IFNULL(IFNULL(edfAssigned6.Value,edfDefault6.value),\'\') = \'Windows Workstation\'))))))))))\r\n' as `SQL`,
'4' as `QueryType`,
'Select||=||=||=|^Select|||||||^' as `ListData`,
'0' as `FolderID`,
'9252f5c6-e4d4-421a-a4f9-1cb44c154b30' as `GUID`,
'<LabTechAbstractSearch><asn><st>AndNode</st><cn><asn><st>AndNode</st><cn><asn><st>ComparisonNode</st><lon>Computer.Location.Extra Data Field.Exclusions.Exclude Msiexec Eventlog Monitoring</lon><lok>Computer.Location.Edf.ac2227dd-0831-4349-a0fb-be75253f727e</lok><lmo>IsFalse</lmo><dv>NULL</dv><dk>NULL</dk></asn><asn><st>ComparisonNode</st><lon>Computer.Extra Data Field.Exclusion.Exclude Msiexec Eventlog Monitoring</lon><lok>Computer.Edf.2f55ffe3-0830-4b46-8303-8f969e0f6228</lok><lmo>IsFalse</lmo><dv>NULL</dv><dk>NULL</dk></asn><asn><st>ComparisonNode</st><lon>Computer.OS.Type</lon><lok>Computer.OS.Type</lok><lmo>Equals</lmo><dv>Windows</dv><dk>1</dk></asn><asn><st>OrNode</st><cn><asn><st>AndNode</st><cn><asn><st>ComparisonNode</st><lon>Computer.OS.IsServer</lon><lok>Computer.OS.IsServer</lok><lmo>IsTrue</lmo><dv>NULL</dv><dk>NULL</dk></asn><asn><st>OrNode</st><cn><asn><st>ComparisonNode</st><lon>Computer.Client.Extra Data Field.Monitoring.Msiexec Eventlog Monitoring</lon><lok>Computer.Client.Edf.3f77d017-1375-4bd6-b1d1-bc9374a30958</lok><lmo>Equals</lmo><dv>Windows</dv><dk>Windows</dk></asn><asn><st>ComparisonNode</st><lon>Computer.Client.Extra Data Field.Monitoring.Msiexec Eventlog Monitoring</lon><lok>Computer.Client.Edf.3f77d017-1375-4bd6-b1d1-bc9374a30958</lok><lmo>Equals</lmo><dv>Windows Server</dv><dk>Windows Server</dk></asn></cn></asn></cn></asn><asn><st>AndNode</st><cn><asn><st>ComparisonNode</st><lon>Computer.OS.IsServer</lon><lok>Computer.OS.IsServer</lok><lmo>IsFalse</lmo><dv>NULL</dv><dk>NULL</dk></asn><asn><st>OrNode</st><cn><asn><st>ComparisonNode</st><lon>Computer.Client.Extra Data Field.Monitoring.Msiexec Eventlog Monitoring</lon><lok>Computer.Client.Edf.3f77d017-1375-4bd6-b1d1-bc9374a30958</lok><lmo>Equals</lmo><dv>Windows</dv><dk>Windows</dk></asn><asn><st>ComparisonNode</st><lon>Computer.Client.Extra Data Field.Monitoring.Msiexec Eventlog Monitoring</lon><lok>Computer.Client.Edf.3f77d017-1375-4bd6-b1d1-bc9374a30958</lok><lmo>Equals</lmo><dv>Windows Workstation</dv><dk>Windows Workstation</dk></asn></cn></asn></cn></asn></cn></asn></cn></asn></cn></asn></LabTechAbstractSearch>' as `SearchXML`,
(NULL) as `UpdatedBy`,
(NULL) as `UpdateDate`
FROM  (SELECT MIN(computerid) FROM computers) a
Where (SELECT count(*) From SensorChecks where `GUID` = '9252f5c6-e4d4-421a-a4f9-1cb44c154b30') = 0 ;

Step 3

Obtain the group ID(s) of the group(s) that the remote monitor should be applied to.

Step 4

Copy the following query and replace YOUR COMMA SEPARATED LIST OF GROUPID(S) with the group ID(s) for your target groups. Set the desired values for the @intervalMinutes and @threshold variables as needed.
(The section to replace is at the very end of the query, immediately after WHERE.)

SET @intervalMinutes = '<Time interval in minutes to look back in the event log>';
SET @threshold = '<Threshold for the minimum number of error events to trigger alerting>';

SET @intervalSeconds = @intervalMinutes * 60;
SET @searchId = IFNULL((SELECT MIN(SensID) FROM sensorchecks Where `GUID` = '9252f5c6-e4d4-421a-a4f9-1cb44c154b30'),0);
INSERT INTO groupagents 
 SELECT '' as `AgentID`,
`groupid` as `GroupID`,
@searchId as `SearchID`,
'ProVal - Production - Excessive MsiInstaller Error Events' as `Name`,
'6' as `CheckAction`,
'1' as `AlertAction`,
'Multiple MSI Installer Errors Detected for %COMPUTERNAME%</li><li></li><li></li><li>No error events from the MsiInstaller source have been detected since the last check.!!!Multiple MSI Installer Errors Detected for %COMPUTERNAME%</li><li></li><li></li><li>%RESULT%\r\n\r\nPlease review the event log errors and investigate any ongoing or failed MSI installations. If any Msiexec processes are stuck or unexpected, further troubleshooting may be required.' as `AlertMessage`,
'0' as `ContactID`,
@intervalSeconds as `interval`,
'127.0.0.1' as `Where`,
'7' as `What`,
CONCAT('C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass -Command "$ErrorActionPreference = \'SilentlyContinue\'; $ProgressPreference = \'SilentlyContinue\'; $InformationPreference = \'Continue\'; $im = ',@intervalMinutes,'; $th = ',@intervalMinutes,'; $tr = (Get-Date).AddMinutes(-$im); $ln = \'Application\'; $pn = \'MsiInstaller\'; $del = Get-WinEvent -FilterHashtable @{ LogName = $ln; Level = 1,2; StartTime = $tr; ProviderName = $pn } -ErrorAction SilentlyContinue; if ($del) { $del = $del | Group-Object -Property Level, ProviderName, Id, LogName | Sort-Object -Property Count -Descending | Select-Object -Property Count,Name,Group; foreach($group in $del) { $mrge = $group.Group | Sort-Object -Property TimeCreated -Descending | Select-Object -First 1; $group | Add-Member -MemberType NoteProperty -Name MostRecentDate -Value $mrge.TimeCreated; $group | Add-Member -MemberType NoteProperty -Name MostRecentMessage -Value $mrge.Message; $group | Add-Member -MemberType NoteProperty -Name Eventid -Value $mrge.Id; $group | Add-Member -MemberType NoteProperty -Name Level -Value $mrge.LevelDisplayName; $group | Add-Member -MemberType NoteProperty -Name Source -Value $mrge.ProviderName; $group | Add-Member -MemberType NoteProperty -Name LogName -Value $mrge.LogName } }; $del = $del | Select-Object -Property Count, EventId, Level, Source, LogName, MostRecentDate, MostRecentMessage; $dec = ($del | Select-Object -Property Count | Measure-Object -Property Count -Sum).Sum; if ($dec -ge $th) { $mpi = Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -match \'Msiexec\' } | Select-Object -Property Name, ProcessId, CommandlIne, ExecutablePath, CreationDate; Write-Information ("Detected {0} error event(s) from the \'MsiInstaller\' event source within the past {1} minutes. Event log details:" -f $dec, $im); Write-Information (\'{0}\' -f ($del | Format-List | Out-String)); if ($mpi) { Write-Information (\'Active Msiexec process(es) currently running on this system:\'); Write-Information (\'{0}\' -f ($mpi | Format-List | Out-String)) } }"') as `DataOut`,
'16' as `Comparor`,
'10|((^((OK){0,}(\\r\\n){0,}[\\r\\n]{0,}\\s{0,})$)%7C(^$))|11|((^((OK){0,}(\\r\\n){0,}[\\r\\n]{0,}\\s{0,})$)%7C(^$))%7C(^((\\r\\n){0,}[\\r\\n]{0,}\\s{0,})Detected)|10|^((\\r\\n){0,}[\\r\\n]{0,}\\s{0,})Detected' as `DataIn`,
'' as `IDField`,
'0' as `AlertStyle`,
'0' as `ScriptID`,
'' as `datacollector`,
'21' as `Category`,
'0' as `TicketCategory`,
'1' as `ScriptTarget`,
(UUID()) as `GUID`,
'root' as `UpdatedBy`,
(NOW()) as `UpdateDate`
FROM mastergroups m
WHERE m.groupid IN (YOUR COMMA SEPARATED LIST OF GROUPID(S))
AND m.groupid NOT IN  (SELECT DISTINCT groupid FROM groupagents WHERE `Name` = 'ProVal - Production - Excessive MsiInstaller Error Events')

Step 5

Here is an example showing how to use a specific group ID and set the variables:

SET @intervalMinutes = '15';
SET @threshold = '20';

SET @intervalSeconds = @intervalMinutes * 60;
SET @searchId = IFNULL((SELECT MIN(SensID) FROM sensorchecks Where `GUID` = '9252f5c6-e4d4-421a-a4f9-1cb44c154b30'),0);
INSERT INTO groupagents 
 SELECT '' as `AgentID`,
`groupid` as `GroupID`,
@searchId as `SearchID`,
'ProVal - Production - Excessive MsiInstaller Error Events' as `Name`,
'6' as `CheckAction`,
'1' as `AlertAction`,
'Multiple MSI Installer Errors Detected for %COMPUTERNAME%</li><li></li><li></li><li>No error events from the MsiInstaller source have been detected since the last check.!!!Multiple MSI Installer Errors Detected for %COMPUTERNAME%</li><li></li><li></li><li>%RESULT%\r\n\r\nPlease review the event log errors and investigate any ongoing or failed MSI installations. If any Msiexec processes are stuck or unexpected, further troubleshooting may be required.' as `AlertMessage`,
'0' as `ContactID`,
@intervalSeconds as `interval`,
'127.0.0.1' as `Where`,
'7' as `What`,
CONCAT('C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass -Command "$ErrorActionPreference = \'SilentlyContinue\'; $ProgressPreference = \'SilentlyContinue\'; $InformationPreference = \'Continue\'; $im = ',@intervalMinutes,'; $th = ',@intervalMinutes,'; $tr = (Get-Date).AddMinutes(-$im); $ln = \'Application\'; $pn = \'MsiInstaller\'; $del = Get-WinEvent -FilterHashtable @{ LogName = $ln; Level = 1,2; StartTime = $tr; ProviderName = $pn } -ErrorAction SilentlyContinue; if ($del) { $del = $del | Group-Object -Property Level, ProviderName, Id, LogName | Sort-Object -Property Count -Descending | Select-Object -Property Count,Name,Group; foreach($group in $del) { $mrge = $group.Group | Sort-Object -Property TimeCreated -Descending | Select-Object -First 1; $group | Add-Member -MemberType NoteProperty -Name MostRecentDate -Value $mrge.TimeCreated; $group | Add-Member -MemberType NoteProperty -Name MostRecentMessage -Value $mrge.Message; $group | Add-Member -MemberType NoteProperty -Name Eventid -Value $mrge.Id; $group | Add-Member -MemberType NoteProperty -Name Level -Value $mrge.LevelDisplayName; $group | Add-Member -MemberType NoteProperty -Name Source -Value $mrge.ProviderName; $group | Add-Member -MemberType NoteProperty -Name LogName -Value $mrge.LogName } }; $del = $del | Select-Object -Property Count, EventId, Level, Source, LogName, MostRecentDate, MostRecentMessage; $dec = ($del | Select-Object -Property Count | Measure-Object -Property Count -Sum).Sum; if ($dec -ge $th) { $mpi = Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -match \'Msiexec\' } | Select-Object -Property Name, ProcessId, CommandlIne, ExecutablePath, CreationDate; Write-Information ("Detected {0} error event(s) from the \'MsiInstaller\' event source within the past {1} minutes. Event log details:" -f $dec, $im); Write-Information (\'{0}\' -f ($del | Format-List | Out-String)); if ($mpi) { Write-Information (\'Active Msiexec process(es) currently running on this system:\'); Write-Information (\'{0}\' -f ($mpi | Format-List | Out-String)) } }"') as `DataOut`,
'16' as `Comparor`,
'10|((^((OK){0,}(\\r\\n){0,}[\\r\\n]{0,}\\s{0,})$)%7C(^$))|11|((^((OK){0,}(\\r\\n){0,}[\\r\\n]{0,}\\s{0,})$)%7C(^$))%7C(^((\\r\\n){0,}[\\r\\n]{0,}\\s{0,})Detected)|10|^((\\r\\n){0,}[\\r\\n]{0,}\\s{0,})Detected' as `DataIn`,
'' as `IDField`,
'0' as `AlertStyle`,
'0' as `ScriptID`,
'' as `datacollector`,
'21' as `Category`,
'0' as `TicketCategory`,
'1' as `ScriptTarget`,
(UUID()) as `GUID`,
'root' as `UpdatedBy`,
(NOW()) as `UpdateDate`
FROM mastergroups m
WHERE m.groupid IN (2,3,855,856)
AND m.groupid NOT IN  (SELECT DISTINCT groupid FROM groupagents WHERE `Name` = 'ProVal - Production - Excessive MsiInstaller Error Events')

Step 6

Execute your query from a RAWSQL monitor set.

Step 7

Reload the System Cache (Ctrl + R).

Step 8

Find your remote monitor in the group's remote monitors tab. Make sure it is limited to the Msiexec Eventlog Monitoring search and apply the correct alert template.
When assigning the alert template, ensure it does not trigger actions for WARNINGS unless you want notifications for PowerShell errors as well.

Summary​

Details​

Target​

EDF​

Ticketing​

Implementation​

Step 1​

Step 2​

Step 3​

Step 4​

Step 5​

Step 6​

Step 7​

Step 8​