In a nutshell: use the ‘eventcreate‘

I had an issue with ITM Windows Agent creating events which I was then sending out email alerts via a UNIX script.

The simple problem was backslashes in windows paths where the “Take Action” notification script was literalizing characters which might be part of the EventLog Description

For example:

"c:\Damned these\nagging\slashes\argh"

became

c:\Damned these
agging\slashesrgh

Yes, simply quoting my string would have solved most of my problem, IT DID HOWEVER lead me to a handy windows command for testing, called ‘eventcreateid‘

Example : eventcreate /ID 101 /SO FooBar /D “Test Message for ITM” /T ERROR /L Application