Thanks
Nikola

Everything is correct except event tag - it should be

<event params="1">100005</event>

Value in params attribute should match number of capture groups in regular expression (1 in your case).

Best regards,
Victor

I've managed that, but the problem is that every error has the same name and description.
Is it possible to pull out the description from the Microsoft event viewer log (ID, general description for the error)

I’ve tried adding, combining macros http://wiki.netxms.org/wiki/UM:Event_Processing but no success.
Am I doing something wrong?

xml file

<parser>
<file>*Application</file>
  <rules>
    <rule>
      <level>1</level>
      <match>(.*)</match>
      <event params="*">100005</event>
    </rule>
  </rules>
</parser>

Thank you

Yes, you can setup Windows event log monitoring. There is a documentation part on log monitoring: https://www.netxms.org/documentation/adminguide/log-monitoring.html. To specify event log instead of file, prefix event log name with asterisk, like this:

<file>*System</file>

to parse system event log.

Best regards,
Victor