My preference is to define component monitors such that the "thresholds" defined can determine it's status regardless of component monitor type. The sustained threshold logic in the component monitors (x consecutive polls; x out of y polls) make it even more practical to push the status logic to the component monitor definition. You should be able to rely on the generic 'alert me when a component monitor is down/warning or critical status" alerts regardless of component monitor type. So, I was saying
- no, you shouldn't have to create 1 alert for event log monitor and 1 for other component types
- with the SQL macro, you can conditionally include the event log messages in the trigger action message only when the component is an event log monitor. However, after aLTeReGo's reply that the macro can be included in the message regardless of type and will be ignored for all other types, wrapping the eventlog message macro in a SQL macro I suggested is redundant. Regarding your question of "should I include a message that the following may appear if this is a windows event log monitor", you can modify the SQL macro I suggested to concatenate this label to the event log messages macro so that the label + event log messages appear only for Windows event log monitors.
I'm not sure why the application custom properties aren't available for component monitor alerts
