In a nutshell: use the ‘eventcreate‘
I had an issue with ITM Windows Agent creating events which I was then sending out email alerts via a UNIX script.
The simple problem was backslashes in windows paths where the “Take Action” notification script was literalizing characters which might be part of the EventLog Description
For example:
"c:\Damned these\nagging\slashes\argh"
became
c:\Damned these agging\slashesrgh
Yes, simply quoting my string would have solved most of my problem, IT DID HOWEVER lead me to a handy windows command for testing, called ‘eventcreateid‘
Example : eventcreate /ID 101 /SO FooBar /D “Test Message for ITM” /T ERROR /L Application
