You may experience one of the following issues while using System Center 2012 Orchestrator Service Pack 1 (SP1) Monitor Event Log activity:
1. Monitor Event Log fires every time there is any new event in the specified event log on the specified computer, regardless of filters on the Monitor Event Log activity.
2. If the event does not match the filters, the published data of the ‘Monitor Event Log’ activity will be empty for all the usual fields (‘Log Entry ID’, ‘Log entry description’, etc).
Microsoft is aware of this issue and is currently investigating. More information will be posted as it becomes available.
To work around this issue, put the same filter condition as in the Monitor Event Log activity in the link condition after the Monitor Event Log activity. That way, activities after Monitor Event Log will only execute if an event matching the filter occurs.
for other considerations.