NT Eventlog / Trigger Alert

All questions related to installations, configurations and maintenance of Advanced Host Monitor (including additional tools such as RMA for Windows, RMA Manager, Web Servie, RCC).
Post Reply
jfreude
Posts: 27
Joined: Tue Oct 19, 2004 7:14 am

NT Eventlog / Trigger Alert

Post by jfreude »

Hi everbody,

is it possible to monitor a NT Eventlog, that an alert is triggerde if there are more than x errors were logged within a specific time range, e.g. more than 20 errors within a minute?

Regards & Thanks,

Juergen
KS-Soft
Posts: 13012
Joined: Wed Apr 03, 2002 6:00 pm
Location: USA
Contact:

Post by KS-Soft »

You may use Shell Script test method and script like this one

Code: Select all

'gets number of NT Event Log records added within last hour
'parameters: computername logfilename
'-----------------------------------------------------------

Option Explicit

const statusAlive       = "scriptRes:Host is alive:"
const statusDead        = "scriptRes:No answer:"
const statusUnknown     = "scriptRes:Unknown:"
const statusNotResolved = "scriptRes:Unknown host:"
const statusOk          = "scriptRes:Ok:"
const statusBad         = "scriptRes:Bad:"
const statusBadContents = "scriptRes:Bad contents:"

'---- entry point ----

dim objArgs, strComputer, strLogfile
dim objWMIService, colLoggedEvents, strWMIQuery, wbemDate
Set objArgs = WScript.Arguments
 
if objArgs.Count>1 then
 strComputer = objArgs(0) 
 strLogfile = objArgs(1) 
 
 Set wbemDate = CreateObject("WbemScripting.SWbemDateTime")
 wbemDate.SetVarDate(DateAdd("h",-1,Now))
 strWMIQuery = "Select * from Win32_NTLogEvent Where (Logfile='" & strLogfile & "') and (timewritten>'" & wbemDate & "')"
 Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") 
 Set colLoggedEvents = objWMIService.ExecQuery(strWMIQuery)
 WScript.StdOut.WriteLine statusOk & colLoggedEvents.Count
 
else
 WScript.StdOut.WriteLine statusUnknown & "Not enough parameters specified" 
end if
Regards
Alex
Post Reply