$ 0 0 yes, component type 42 means "Windows Event Log Monitor", and instead of component status, it makes more sense to trigger on statistic data (which in case of this component stands for number of events matching given criteria):