We primarily installed SCOM for audit puposes but will grow it to include more functionality. One of our report requirements is to provide information on any patch\hotfix installs. Normally these will show up as event id 19, 4371, and 4377. We can see those installation events on a server after a patch has been installed but are unable to see them in our SCOM reports. In the ACS report for "Forensic - All Events With a Specified ID" the dropdown list doesn't include these event numbers. We can, however, report on other events on the same server. How can we add those event IDs to our reporting base?
thanks!
Steve