Windows Event Log Scanner operation

The Windows Event Log Scanner works slightly differently from most other up.time monitors.  The principle difference is that it does not utilize a Recheck field.

In up.time versions up to 5.4, the monitor functioned by scanning the Event Log entries based on the value specified in the Number of Lines field.  When the monitor runs, it creates a temp check.  The next time it runs, it starts scanning the Event Logs from the temp check point going forward, up to the number of lines specified.  Only events generated since the last time the monitor was run will be detected, which ensures that events will alert only once and then have their status cleared on the next run.

In up.time 5.5, the WMI implementation was optimized by implementing a (non-configurable) 15-minute interval to scan Events instead of the Number of Lines variable.