Forgive my Noobness, but I am having difficulties getting a Rule to work.

We have recently installed Altiris Monitoring on all of our servers. I have been tasked with the configuration of a Portal and with Real Time Information gathering.

As part of this, I created a rule to alert us if a Server was restarted based on an NT Event...whether it be a graceful restart or an unexpected shut down.

My rules basically say if Event Source and Log Source and Event Type = A, then send an E-Mail.

So far with my testing, I have been unsuccessful in generating an E-Mail.

I am thinking maybe I have the rule under the wrong metric, but I'm not sure. Any ideas would to lead me in the right direction would be brilliant.

Regards

Craig