event supervise
in [VbScript]
|
Prev: Scheduled Defrag
Next: for..in..do
From: Walser Mark on 5 Nov 2007 09:07 hello ng I will supervise a event log entry from AxaptaCom with a script. Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") Set colItems = objWMIService.ExecQuery("Select * from Win32_NTLogEvent where LogFile ='AxaptaCOM'") ...... .... when the event occurs then will send a mail to the administrator. thanks
From: Pegasus (MVP) on 5 Nov 2007 12:41 "Walser Mark" <mw(a)jansen.local> wrote in message news:D0BC42ED-8ABE-4F43-AD43-01071B4A9E62(a)microsoft.com... > hello ng > > I will supervise a event log entry from AxaptaCom with a script. > > Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") > Set colItems = objWMIService.ExecQuery("Select * from Win32_NTLogEvent > where LogFile ='AxaptaCOM'") > ..... > ... > > when the event occurs then will send a mail to the administrator. > > thanks > And what is your question?
From: Walser Mark on 9 Nov 2007 07:55 hello I search an example. When a event log entry, what I must do? I think the script look every 5 minutes into it. When it entry, then will send a e-mail. greets "Pegasus (MVP)" <I.can(a)fly.com> schrieb im Newsbeitrag news:%23CZNTM9HIHA.5160(a)TK2MSFTNGP05.phx.gbl... > > "Walser Mark" <mw(a)jansen.local> wrote in message > news:D0BC42ED-8ABE-4F43-AD43-01071B4A9E62(a)microsoft.com... >> hello ng >> >> I will supervise a event log entry from AxaptaCom with a script. >> >> Set objWMIService = GetObject("winmgmts:\\" & strComputer & >> "\root\cimv2") >> Set colItems = objWMIService.ExecQuery("Select * from Win32_NTLogEvent >> where LogFile ='AxaptaCOM'") >> ..... >> ... >> >> when the event occurs then will send a mail to the administrator. >> >> thanks >> > > And what is your question? >
From: Pegasus (MVP) on 9 Nov 2007 16:59 You could use the Task Scheduler to invoke this script once every five minutes: CutOffTime = FormatDateTime(DateAdd("n", - 6, Now())) Set objWMIService = GetObject("winmgmts:\\.\root\cimv2") Set colItems = objWMIService.ExecQuery("Select * from Win32_NTLogEvent " _ & "where Logfile = 'System' " _ & "and EventCode = '4201' " _ & "and TimeWritten > '" & CutOffTime & "'") WScript.Echo "Count=" & colItems.Count If colItems.Count > 0 Then For Each objItem In colItems WScript.echo objItem.SourceName & " " & objItem.TimeWritten Next End If Instead of writing the events to the screen, you could send them to the administrator. "Walser Mark" <mw(a)jansen.local> wrote in message news:uztJO$sIIHA.4880(a)TK2MSFTNGP03.phx.gbl... > hello > > I search an example. > When a event log entry, what I must do? > I think the script look every 5 minutes into it. > When it entry, then will send a e-mail. > > greets > > > > > "Pegasus (MVP)" <I.can(a)fly.com> schrieb im Newsbeitrag > news:%23CZNTM9HIHA.5160(a)TK2MSFTNGP05.phx.gbl... >> >> "Walser Mark" <mw(a)jansen.local> wrote in message >> news:D0BC42ED-8ABE-4F43-AD43-01071B4A9E62(a)microsoft.com... >>> hello ng >>> >>> I will supervise a event log entry from AxaptaCom with a script. >>> >>> Set objWMIService = GetObject("winmgmts:\\" & strComputer & >>> "\root\cimv2") >>> Set colItems = objWMIService.ExecQuery("Select * from Win32_NTLogEvent >>> where LogFile ='AxaptaCOM'") >>> ..... >>> ... >>> >>> when the event occurs then will send a mail to the administrator. >>> >>> thanks >>> >> >> And what is your question? >> >
From: urkec on 10 Nov 2007 03:32
"Walser Mark" wrote: > hello > > I search an example. > When a event log entry, what I must do? > I think the script look every 5 minutes into it. > When it entry, then will send a e-mail. > This Script Center sample shows how to monitor event logs in real time: http://www.microsoft.com/technet/scriptcenter/scripts/logs/eventlog/lgevvb17.mspx This one shows how to send Email from a script: http://www.microsoft.com/technet/scriptcenter/scripts/message/smtpmail/default.mspx If you don't want your script running all the time you could set up a permanent event consumer. You would need to create instances of three WMI classes: __EventFilter, __EventConsumer and __FilterToConsumerBinding. Here is some code I took from Windows 2000 Scripting Guide: 'connect to WMI locally 'can't use WScript object in Consumer.vbs 'MsgBox will not error out but will not display strComputer = "." Set objSWbemServices = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" _ & strComputer & "\root\cimv2") 'create an instance of __EventFilter class Set objEventFilterClass = objSWbemServices.Get("__EventFilter") Set objEventFilter = objEventFilterClass.SpawnInstance_() objEventFilter.Name = "TestFilter" objEventFilter.QueryLanguage = "WQL" objEventFilter.Query = _ "Select * From __InstanceModificationEvent " &_ "Within 10 Where TargetInstance " &_ "Isa 'Win32_Process' " objEventFilter.Put_ 'create an instance of ActiveScripteventConsumer class Set objConsumerClass = objSWbemServices.Get _ ("ActiveScriptEventConsumer") Set objConsumer = objConsumerClass.SpawnInstance_() objConsumer.Name = "TestConsumer" objConsumer.ScriptFileName = "C:\Consumer.vbs" 'it is .ScriptingEngine instead of .ScriptEngine objConsumer.ScriptingEngine = "VBScript" objConsumer.Put_ 'need to refresh objEventFilter and objConsumer 'before I can use their Path_ property objEventFilter.Refresh_ objConsumer.Refresh_ 'create an instance of __FilterToConsumerBinding class Set objBindingClass = objSWbemServices.Get("__FilterToConsumerBinding") Set objBindingInstance = objBindingClass.SpawnInstance_() 'Filter and Consumer properties are strings containing the absolute path 'to __EventFilter and ActiveScriptEventConsumer instances just created. ' If I want to hardcode the paths I need to use double quotes for Name property 'doesn't work without '\\.\' part objBindingInstance.Filter = objEventFilter.Path_ objBindingInstance.Consumer = objConsumer.Path_ objBindingInstance.Put_() 'After test need to delete all three instances This is just test code, so you would need to adapt it. I used ActiveScriptEventConsumer, which is derived from __EventConsumer, but one of the standard event consumer classes is SMTPEventConsumer, which sends an Email message using SMTP each time an event is delivered to it. Before I could use ActiveScriptEventConsumer, I needed to register it like this: mofcomp -N:root\cimv2 %SYSTEMROOT%\system32\wbem\scrcons.mof I'm not sure about SMTPEventConsumer, but I think you would also need to register it. http://www.microsoft.com/technet/scriptcenter/guide/sas_wmi_tjin.mspx -- urkec |