On Windows Event Log event

You can schedule a backup to start when a certain Windows event has been recorded in one of the event logs, such as the Application, Security, or System log.

For example, you may want to set up a protection plan that will automatically perform an emergency full backup of your data as soon as Windows discovers that your hard disk drive is about to fail.

To browse the events and view the event properties, use the Event Viewer snap-in available in the Computer Management console. To be able to open the Security log, you must be a member of the Administrators group.

Event properties

Log name

Specifies the name of the log. Select the name of a standard log (Application, Security, or System) from the list, or type a log name—for example: Microsoft Office Sessions

Event source

Specifies the event source, which typically indicates the program or the system component that caused the event—for example: disk

Any event source that contains the specified string will trigger the scheduled backup. This option is not case sensitive. Thus, if you specify the string service, both Service Control Manager and Time-Service event sources will trigger a backup.

Event type

Specifies the event type: Error, Warning, Information, Audit success, or Audit failure.

Event ID

Specifies the event number, which typically identifies the particular kind of events among events from the same source.

For example, an Error event with Event source disk and Event ID 7 occurs when Windows discovers a bad block on a disk, whereas an Error event with Event source disk and Event ID 15 occurs when a disk is not ready for access yet.

Example: "Bad block" emergency backup

One or more bad blocks that have suddenly appeared on a hard disk usually indicate that the hard disk drive will soon fail. Suppose that you want to create a protection plan that will back up hard disk data as soon as such a situation occurs.

When Windows detects a bad block on a hard disk, it records an event with the event source disk and the event number 7 into the System log; the type of this event is Error.

When creating the plan, type or select the following in the Schedule section:

• Log name: System
• Event source: disk
• Event type: Error
• Event ID: 7