Jump to content
Sign in to follow this  
LordSphynx

Read the Eventlog and send message

Recommended Posts

LordSphynx

What is wrong with this ?

#include <date.au3>
$today = _NowDate()
$answerLogin = "Username"
$answerDomain = "domain"
$answerPass = "Password"
$ServerList = FileOpen("C:\util\EventLogger\ServerList.txt", 0)
    ;check if file is open
    If $ServerList = -1 Then
        MsgBox(0, "Error", "Unable to open the serverlist")
        Exit
    EndIf

While 1     
        $server = FileReadLine($ServerList)
        If @error = -1 Then ExitLoop

    ; Check for Shutdown or reboot
    TrayTip("EventLogger", "Checking " & $server, 10)
    RunAsSet($answerLogin, $answerDomain, $answerPass, 2)
    $wbemFlagReturnImmediately = 0x10
    $wbemFlagForwardOnly = 0x20
    $colItems = ""
    $strComputer = $server
    $Where_Clause = " WHERE Logfile = 'System' AND SourceName = 'eventlog' AND EventCode = '7000'"
    $objWMIService = ObjGet("winmgmts:\\" & $strComputer & "\root\CIMV2")
    $colItems = $objWMIService.ExecQuery("SELECT * FROM Win32_NT_LogEvent" & $Where_Clause, "WQL", _
                                            $wbemFlagReturnImmediately + $wbemFlagForwardOnly)


    If IsObj($colItems) then
    For $objItem In $colItems
        $Output = $server & " - Message: " & $objItem.Message
        Run('C:\Program Files\KLOG\KLOG Command-line Tools\klog\klog.exe -L Critical -m "' & $Output & '"', "", @SW_MINIMIZE)
    RunAsSet()
    TrayTip("","",0)
    Next
Else
    MsgBox(0, "Eventlogger", $server & " has no shutdown event", 10)
    Endif

WEnd

Share this post


Link to post
Share on other sites
Xenobiologist

Hi,

have a look at Au3Lib maybe there are some easier access ways.

So long,

Mega


Scripts & functions Organize Includes Let Scite organize the include files

Yahtzee The game "Yahtzee" (Kniffel, DiceLion)

LoginWrapper Secure scripts by adding a query (authentication)

_RunOnlyOnThis UDF Make sure that a script can only be executed on ... (Windows / HD / ...)

Internet-Café Server/Client Application Open CD, Start Browser, Lock remote client, etc.

MultipleFuncsWithOneHotkey Start different funcs by hitting one hotkey different times

Share this post


Link to post
Share on other sites
/dev/null

What is wrong with this ?

There is NO error description! That's wrong!


__________________________________________________________(l)user: Hey admin slave, how can I recover my deleted files?admin: No problem, there is a nice tool. It's called rm, like recovery method. Make sure to call it with the "recover fast" option like this: rm -rf *

Share this post


Link to post
Share on other sites
LordSphynx

and where do I find that or help on that ? (Au3Lib)

Edited by LordSphynx

Share this post


Link to post
Share on other sites
PaulIA

and where do I find that or help on that ? (Au3Lib)

That's Auto3Lib. See sig.

Auto3Lib: A library of over 1200 functions for AutoIt

Share this post


Link to post
Share on other sites
ptrex
PaulIA

@all

This is a shorter way.

run CMD and type EventTriggers.exe /?

Runs only in XP

Enjoy !!

ptrex

Can you provide a example that shows how to use this command to search for shutdown or reboot events in the event log?

Auto3Lib: A library of over 1200 functions for AutoIt

Share this post


Link to post
Share on other sites
ptrex

@PaulIA

This example shows how to do something when a EVENTLOG START event has occured.

EventTriggers /create /TR "My Trigger" /l system /eid 6005 /TK C:\ log\time.bat

Usually after a reboot this will happen. It will trigger the BAT file to run, or whatever you want to do otherwise.

Regards

ptrex

Share this post


Link to post
Share on other sites
PaulIA

@PaulIA

This example shows how to do something when a EVENTLOG START event has occured.

EventTriggers /create /TR "My Trigger" /l system /eid 6005 /TK C:\ log\time.bat

Usually after a reboot this will happen. It will trigger the BAT file to run, or whatever you want to do otherwise.

Regards

ptrex

So, unlike reading the event log, all you can do is trigger an event? I'm not sure that's what the OP was asking for, but it's still good information. :rolleyes:

Auto3Lib: A library of over 1200 functions for AutoIt

Share this post


Link to post
Share on other sites
PsaltyDS

Your code had some typos in it. I'm working off of Win32_NTLogEvent. I was interested in something like this for myself, so i took a shot at it. I don't have any event code 7000s in my log, so I changed it 6005 to get some hits. All the stuff for reading computer names from a file and RunAsSet() was extraneous to the issue, so it went away:

$Query_Clause = "Select * FROM Win32_NTLogEvent WHERE Logfile = 'System' AND SourceName = 'eventlog' AND EventCode = 6005"
$objWMIService = ObjGet("winmgmts:{impersonationLevel=impersonate,(Security)}!\\" & @ComputerName & "\root\cimv2")
If IsObj($objWMIService) Then
    $colItems = $objWMIService.ExecQuery ($Query_Clause)
    If IsObj($colItems) Then
        For $objEvent In $colItems
            $Output = ""
            $Output &= "Category: " & $objEvent.Category & @CRLF
            $Output &= "Computer Name: " & $objEvent.ComputerName & @CRLF
            $Output &= "Event Code: " & $objEvent.EventCode & @CRLF
            $Output &= "Message: " & $objEvent.Message & @CRLF
            $Output &= "Record Number: " & $objEvent.RecordNumber & @CRLF
            $Output &= "Source Name: " & $objEvent.SourceName & @CRLF
            $Output &= "Time Written: " & $objEvent.TimeWritten & @CRLF
            $Output &= "Event Type: " & $objEvent.Type & @CRLF
            $Output &= "User: " & $objEvent.User & @CRLF
            If MsgBox(64 + 4, "Entry Found:", $Output & @CRLF & @CRLF & "Continue?") = 7 Then Exit
        Next
    Else
        MsgBox(16, "Error", "$colItems is not an object.")
    EndIf
Else
    MsgBox(16, "Error", "$objWMIService is not an object.")
EndIf

You can use this to refine your WQL query and then put the other stuff back in.

:rolleyes:

Edit: Tweaked to quit easier...

Edited by PsaltyDS

Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law

Share this post


Link to post
Share on other sites
PsaltyDS

how to use?

Use what, to do what? If you mean my code in post #10, it reads entries from the event logs. What are you wanting to do?

:rolleyes:


Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law

Share this post


Link to post
Share on other sites
PsaltyDS

i wanna read only the error messages from remote pc

Change the ObjGet() to use your remote computer name vice the @ComputerName macro, and edit the WQL query string to match what you want. For starters, you want change or delete the part to match an EventCode, and add EventType 1 (see the MSDN link in my post).

:rolleyes:


Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law

Share this post


Link to post
Share on other sites
PsaltyDS

no matter what conditions i put in the WQL query string

i get "$objWMIService is not an object"

i verify that the conditions in fact exist - any ideas?

$asset = "l00799987"

$Query_Clause = "Select * FROM Win32_NTLogEvent WHERE Logfile = 'Application' AND SourceName = 'Altiris Recovery Solution' AND EventCode = 31"
$objWMIService = ObjGet("winmgmts:{impersonationLevel=impersonate,(Security)}!\\" & $asset & "\root\cimv2")
If IsObj($objWMIService) Then

    ; ...<snip>

Else
     MsgBox(16, "Error", "$objWMIService is not an object.")
EndIf
The computer name is really "l00799987" (named after asset tag, maybe)? If so, ensure that "Windows Management Instrumentation" (WMI) service is running, and you have an admin account on the computer, then try it this way:
$sComputerName = "MyComputer"

$objSWbemLocator = ObjCreate("WbemScripting.SWbemLocator")
$objWMIService = $objSWbemLocator.ConnectServer _
    ($sComputerName, "root\cimv2", $sComputerName & "\Administrator", "AdministratorPassword")
$objWMIService.Security_.ImpersonationLevel = 3

$Query_Clause = "Select * FROM Win32_NTLogEvent WHERE Logfile = 'System' AND SourceName = 'eventlog' AND EventCode = 6005"
If IsObj($objWMIService) Then
    $colItems = $objWMIService.ExecQuery ($Query_Clause)
    If IsObj($colItems) Then
        For $objEvent In $colItems
            $Output = ""
            $Output &= "Category: " & $objEvent.Category & @CRLF
            $Output &= "Computer Name: " & $objEvent.ComputerName & @CRLF
            $Output &= "Event Code: " & $objEvent.EventCode & @CRLF
            $Output &= "Message: " & $objEvent.Message & @CRLF
            $Output &= "Record Number: " & $objEvent.RecordNumber & @CRLF
            $Output &= "Source Name: " & $objEvent.SourceName & @CRLF
            $Output &= "Time Written: " & $objEvent.TimeWritten & @CRLF
            $Output &= "Event Type: " & $objEvent.Type & @CRLF
            $Output &= "User: " & $objEvent.User & @CRLF
            If MsgBox(64 + 4, "Entry Found:", $Output & @CRLF & @CRLF & "Continue?") = 7 Then Exit
        Next
    Else
        MsgBox(16, "Error", "$colItems is not an object.")
    EndIf
Else
    MsgBox(16, "Error", "$objWMIService is not an object.")
EndIf

:mellow:


Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×