Daily we get an email from servers that complete their Veeam backups. Were virtual and you might know Veeam as one of the top virtual machine backup applications. What happens is it starts a service that assists with vss snapshots on servers running things like Exchange or SQL, so it's not entirely a crash-consistent backup. When the backup is done, it writes to the event log that it is removing its service. Eventsentry picks up on this and emails the IT team. We just ignore it because we understand the timing of these emails and the contents of the message coincides with the backup job. Here is an example message:
EVENT # 139416
EVENT LOG Application
EVENT TYPE Error
CATEGORY Service Monitoring
EVENT ID 10102
DATE / TIME 6/4/2014 10:40:19 PM
MESSAGE A service was removed: veeamvsssupport (VeeamVssSupport).
Additional Service Information:
Startup type: Automatic
Service account: LocalSystem
Now under Generic Windows I created an Exclude filter called Veeam. In it I have Application log checked, and Information, Warning and Error checked for Severity. For Source I have EventSentry. For Category I have Service Monitoring. For Content Filter & Notes I have one Wildcard entry with the filter text veeamvsssupport.
The particular machine here does have "generic windows" as an Assigned Event Log Package (among a few others as well). Its running the agent version 18.104.22.168.
Last night I got an email again (as you can see above). I'm not sure, but does it look like I'm missing anything?