Services.xml

<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
  <SubscriptionId>Services</SubscriptionId>
  <SubscriptionType>SourceInitiated</SubscriptionType>
  <Description>Service installation, modification, and errors.</Description>
  <Enabled>true</Enabled>
  <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
  <ConfigurationMode>Custom</ConfigurationMode>
  <Delivery Mode="Push">
    <Batching>
      <MaxItems>1</MaxItems>
      <MaxLatencyTime>300000</MaxLatencyTime>
    </Batching>
    <PushSettings>
      <Heartbeat Interval="1800000"/>
    </PushSettings>
  </Delivery>
  <Query><![CDATA[
    <QueryList>
      <Query Id="0" Path="System">
        <!-- Inspired by Microsoft Documentation and/or IADGOV -->
        <!-- Service Control Manager Failures and Crashes -->
        <!-- 7022: The service hung on starting -->
        <!-- 7023: The service terminated with the following error -->
        <!-- 7023: The service terminated with the following error -->
        <!-- 7024: The service terminated with service-specific error -->
        <!-- 7026: The following boot-start or system-start driver(s) failed to load -->
        <!-- 7031: The service terminated unexpectedly. It has done this x time(s). The following corrective action will be taken in y milliseconds -->
        <Select Path="System">*[System[Provider[@Name='Service Control Manager'] and (Level=1 or Level=2 or Level=3 or Level=4 or Level=0) and (EventID=7022 or EventID=7023 or EventID=7024 or EventID=7026 or EventID=7031 or EventID=7032 or EventID=7034)]]</Select>
        <!-- 7040: Service Start Type Changed -->
        <!-- 7045: Service Installed -->
        <Select Path="System">*[System[Provider[@Name='Service Control Manager'] and (Level=1 or Level=2 or Level=3 or Level=4 or Level=0) and (EventID=7045 or EventID=7040)]]</Select>
      </Query>
    </QueryList>]]></Query>
  <ReadExistingEvents>true</ReadExistingEvents>
  <TransportName>http</TransportName>
  <ContentFormat>RenderedText</ContentFormat>
  <Locale Language="en-US"/>
  <LogFile>WEC-Services</LogFile>
  <AllowedSourceNonDomainComputers/>
  <AllowedSourceDomainComputers>O:NSG:NSD:(A;;GA;;;DC)(A;;GA;;;NS)(A;;GA;;;DD)</AllowedSourceDomainComputers>
</Subscription>