Monitoring Windows event logs for error level events

Home

Forums

Feature Requests

Beta Issues

SysAid Resources

Documentation

Support

Hello Guest,

DOWNLOAD FREE EDITION

Recent Topics

Hottest Topics

Online Members

Member Listing

Advanced Search

Monitoring Windows event logs for error level events

Forum Index » Monitoring

Author

Message

05/01/2012 20:23:59

Subject: Monitoring Windows event logs for error level events

joej
SysAider

SysAider from release 5

Joined: 28/10/2008
Messages: 2
Offline

Is there a way to monitor windows event logs for errors? What I want to do is to monitor the Windows logs for Error level events.

05/02/2012 15:47:34

Subject: Re:Monitoring Windows event logs for error level events

leon.shlimak
SysAid Customer Relations

Joined: 28/09/2011
Messages: 52
Offline

Hi Joej.
Unfortunately, you can not. The available features for monitoring can be found here:
http://www.ilient.com/help-page.htm?helpPageId=4197&helpPageName=MonitorConfigurationEdit.htm&edition=0&version=v8.5.03&productId=1

Thanks

25/04/2012 14:19:21

Subject: Re:Monitoring Windows event logs for error level events

deChrLam
SysAider

SysAider from release 7.5

Joined: 16/09/2011
Messages: 7
Offline

Damn right there is way to monitor system and application and security logs using custom monitoring on Enterprise edition.

This code will look for a specific message in the windows logs.
The newest of the specific message will be reported and its date and time written to a temp file.
The next time it runs(every 5 minutes), it finds the newest instance of the specific message and checks to see if it is newer than the date and time in the temp file.
If it is, then it makes the .dat file for SysAIDS custom monitoring.

Choose the name of the file wisely, save as .vbs and read the docs on custom monitoring and you can monitor anything in the windows event logs.

copy pasta code for big win!!!

njoy

' This is a custom monitoring script for sysaid for monitoring the Windows Event Log
' It is generic and will scan logs and events according to how this file is named
'
' This file should be named like this:
' EventLog.System | Application | Security[Source](1234).vbs
' Example: EventLog.Application[MSSQL$INST1](17177).vbs
' The example will scan the Application Log for events from soucre MSSQL$INST1 with evend id 17177
'
' This file is to be placed in the C:\Program Files (x86)\SysAid\scripts directory
' The scripts directory does not exist as standard and must be created first

Dim strLogType
Dim strLogEventNumber
Dim strLogSourceName

strLogType = ""
strLogSourceName = ""

IF INSTR(Wscript.ScriptName, "Application") <> 0 THEN strLogType = "Application"
IF INSTR(Wscript.ScriptName, "System") <> 0 THEN strLogType = "System"
IF INSTR(Wscript.ScriptName, "Security") <> 0 THEN strLogType = "Security"
IF strLogType = "" THEN Wscript.quit
IF INSTR(Wscript.ScriptName, "(") = 0 THEN Wscript.Quit
IF INSTR(Wscript.ScriptName, ")") = 0 THEN Wscript.Quit
IF INSTR(Wscript.ScriptName, ")") - INSTR(Wscript.ScriptName, "(") > 6 THEN Wscript.Quit
IF INSTR(Wscript.ScriptName, ")") - INSTR(Wscript.ScriptName, "(") < 2 THEN Wscript.Quit

IF INSTR(Wscript.ScriptName, "[") = 0 THEN Wscript.Quit
IF INSTR(Wscript.ScriptName, "]") = 0 THEN Wscript.Quit
IF INSTR(Wscript.ScriptName, "]") - INSTR(Wscript.ScriptName, "[") < 2 THEN Wscript.Quit

strLogEventNumber = MID(Wscript.ScriptName, INSTR(Wscript.ScriptName, "(") + 1, INSTR(Wscript.ScriptName, ")") - INSTR(Wscript.ScriptName, "(") -1)
strLogSourceName = MID(Wscript.ScriptName, INSTR(Wscript.ScriptName, "[") + 1, INSTR(Wscript.ScriptName, "]") - INSTR(Wscript.ScriptName, "[") -1)

'Wscript.echo(strLogType)
'Wscript.echo(strLogEventNumber)
'wscript.quit

Dim strDirectory, strFile, strText
Dim objTextFile, objFSO, objFolder
Const ForAppending = 8
Const ForWriting = 2
Const ForReading = 1

strDirectory = "C:\Program Files (x86)\SysAid\scripts"
strFile = "\" &  LEFT(Wscript.ScriptName, LEN(Wscript.ScriptName) - 4)
strText = ""
Set objFSO = CreateObject("Scripting.FileSystemObject")

Set objFSO = CreateObject("Scripting.FileSystemObject")
If objFSO.FileExists(strDirectory & strFile & ".txt") Then
  Set objFolder = objFSO.GetFolder(strDirectory)
Else
  Set objTextFile = objFSO.CreateTextFile(strDirectory & strFile & ".txt")
  'Wscript.Echo "Just created " & strDirectory & strFile
End If

Set objTextFile = nothing
Set objFolder = nothing

' Workaround - Stupid sysaids does not wait long enough for the .dat file to be made by the script
' This copies the result from the last execution(from .datt) to the .dat for sysaid

If objFSO.FileExists(strDirectory & strFile & ".datt") Then
   objFSO.CopyFile strDirectory & strFile & ".datt", strDirectory & strFile & ".dat"
END if

Const adVarChar = 200
Const MaxCharacters = 255
Set DataList = CreateObject("ADOR.Recordset")
DataList.Fields.Append "TimeWritten", adVarChar, MaxCharacters
DataList.Open
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
 & "{impersonationLevel=impersonate}!\\" & strComputer& "\root\cimv2")
'Set colLoggedEvents = objWMIService.ExecQuery ("Select * from Win32_NTLogEvent Where Logfile = 'System' AND EventCode = '1503'")

Set colLoggedEvents = objWMIService.ExecQuery ("Select * from Win32_NTLogEvent Where Logfile = '" & strLogType & "' AND EventCode = '" & strLogEventNumber & "' AND SourceName = '" & strLogSourceName & "'")
For Each objEvent in colLoggedEvents
 'Wscript.Echo objEvent.SourceName
 DataList.AddNew
 DataList("TimeWritten") = objEvent.TimeWritten
 DataList.Update
Next
DataList.Sort = "TimeWritten"
'DataList.MoveLast
Do Until DataList.EOF
  'Wscript.Echo DataList.Fields.Item("TimeWritten")
  strLastLogDate = LEFT(DataList.Fields.Item("TimeWritten"), 14)
  'Wscript.Echo strLastLogDate
DataList.MoveNext
Loop

Set objTextFile = objFSO.OpenTextFile(strDirectory & strFile & ".txt", ForReading)

If objTextFile.AtEndOfStream <> True Then
  strText = objTextFile.ReadLine
End If
  objTextFile.Close
  Set objTextFile = nothing

If strLastLogDate > strText Then
  Set objTextFile = objFSO.CreateTextFile(strDirectory & strFile & ".txt", True)
  objTextFile.Write strLastLogDate
  objTextFile.Close
  Set objTextFile = nothing
  Set objTextFile = objFSO.CreateTextFile(strDirectory & strFile & ".datt", True)
  objTextFile.Write "0"
  objTextFile.Close
ELSE
  Set objTextFile = objFSO.CreateTextFile(strDirectory & strFile & ".datt", True)
  objTextFile.Write "1"
  objTextFile.Close
END If

21/05/2012 12:01:34

Subject: Re:Monitoring Windows event logs for error level events

Oleg.Sin
SysAid Product Manager

Joined: 02/01/2011
Messages: 17
Offline

Hello joej,
We have a relevant post in feature request forum here:
http://www.sysaid.com/Sysforums/posts/list/1764.page#8320

Please vote for it, and hopefully we'll develop it in one of our upcoming releases!

Regards,

Oleg

Forum Index » Monitoring

Go to:

Help Desk Software
Free Help Desk Software
Free Asset Management Software
SysAid Helpdesk Software
Web Based Help Desk Software
SysAid Help Desk Forum
General IT Discussion Forum
SysAid CSS Customer Service Software
Customer Support Software

   SysAid Technologies Ltd.
   Toll-Free phone center (U.S.): 1-800-686-7047
   Offices - U.S.617-231-0124
   Israel:+972-3-533-3675
   Skype account:ilient
   Email:helpdesk@sysaid.com
   Optimized by SEO Israel
   SysAid logos and other SysAid Technologies marks
   are trademarks or registered trademarks of
   SysAid Technologies Ltd.
   All Rights Reserved by SysAid Technologies Ltd.
   2002-2011

   Live Support Hours
   07:00 AM - 09:30 PM (UK)
   03:00 AM - 05:30 PM (EDT)

   We provide worldwide services, and we do our best
   to match the working times of customers from
   different time zones.

   SysAid Help Desk Software and Asset Management Software