Collecting Windows Task Scheduler Events

[MaximilianoCitt]

Hi everyone!

I need to retrieve the events generated by Windows Task Scheduler Service, but as far as I saw, this service does not log the events to any of the "common" windows logs channels (Security, Application or System). Does anyone have experience to retrieve this kind of events? 

If so, please tell me the steps to do that.

Regards,

Max

[JoshRandall]

Hi Max,

  These events reside in Event Viewer at /Application and Service Logs/Microsoft/Windows/TaskScheduler.  The log file you likely want to collect from here is "Operational":

You can collect these events by adding "Microsoft-Windows-TaskScheduler/Operational" to your Channel, like this:

These events can be queried using event.source='microsoft-windows-taskscheduler':

Hope this helps.

[MaximilianoCitt]

Thank you so much Joshua! I was wondering something like that, but I wasn't sure about how to call properly the task scheduler channel... thank you!