• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 3364
  • Last Modified:

Windows 2003 Event Log and Error Emails

We're a small company with only 2 servers, both of them are windows 2k3. 1 DC and 1 SQL server. All of our email is pop hosted on a hosted server. I need to come up with a way to receive email notifications from the servers when there are errors and maybe have it email me the event logs daily or maybe weekly.

Is there an easy way to just setup this by sending mail thru my smtp server on the hosted email machine?

thanks,

Mark
0
markj72000
Asked:
markj72000
  • 14
  • 7
  • 3
  • +1
1 Solution
 
jss1199Commented:
I would suggest you use ManageEngine's OpManager which is free for use for 10 devices or less.  You can then leverage performance and event log monitoring for each of your server and setup email alerts.

http://www.manageengine.com/products/opmanager/download-free.html
0
 
flyingskyCommented:
Windows itself cannot do that. You need third party software. For your case, a free one I can recommend is the free edition of Event Log Analyzer from
http://www.manageengine.com/products/eventlog/
You will also need a smtp server though as you don't have Exchange, unless you can send through your hosting company.
0
 
Donald StewartNetwork AdministratorCommented:
"Windows itself cannot do that..."
 sure can!!!
How to use Eventtriggers.exe to send e-mail based on Event IDs
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
flyingskyCommented:
dstewartjr:
I honestly didn't know this command. thanks for the tip.
0
 
Donald StewartNetwork AdministratorCommented:
0
 
Donald StewartNetwork AdministratorCommented:
Always glad to help
0
 
jss1199Commented:
Eventtriggers will still require integration with a 3rd party tool (or external script) to send email alerts as the author requested.
0
 
flyingskyCommented:
"Eventtriggers will still require integration with a 3rd party tool (or external script) to send email alerts as the author requested. "
That's true, that's why i suggest him/her to get a SMTP server if cannot use the hosting email server.
0
 
Donald StewartNetwork AdministratorCommented:
nope, no 3rd party tool just vbs script
 
example below

Dim dtmStart, SearchEventStart
Dim objWMIService, colEvents, objEvent, EventTime
Dim objMessage, eventCounted
Dim ObjSendMail
Set WshNetwork = CreateObject("WScript.Network")
Set ObjSendMail = CreateObject("CDO.Message") 
Const MinutesToSearchWithin = -2 ' look for the event that triggered me within the last 2 minutes
Set dtmStart = CreateObject("WbemScripting.SWbemDateTime")
SearchEventStart = DateAdd("n", MinutesToSearchWithin, Now())
dtmStart.SetVarDate SearchEventStart, True
 
txt = ""
 
strComputer = WshNetwork.ComputerName
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery ("Select * from Win32_NTLogEvent Where Type = 'error' And Logfile = 'Application' And TimeWritten >= '" & dtmStart & "'") 
For Each objEvent in colLoggedEvents
txt = txt &  "Category: " & objEvent.Category
EventTime = Mid(objEvent.TimeWritten, 5, 2) & "/" & Mid(objEvent.TimeWritten, 7, 2) & "/" & _
    Mid(objEvent.TimeWritten, 1, 4) & " " & Mid(objEvent.TimeWritten, 9, 2) & ":" & _
    Mid(objEvent.TimeWritten, 11, 2) & "." & Mid(objEvent.TimeWritten, 13, 2)
txt = txt &  vbCrLf & "Time: " & EventTime
txt = txt &  vbCrLf & "EventCode: " & objEvent.EventCode
txt = txt &  vbCrLf & "Message: " & objEvent.Message
txt = txt &  vbCrLf & "RecordNumber: " & objEvent.RecordNumber
txt = txt &  vbCrLf & "SourceName: " & objEvent.SourceName
txt = txt &  vbCrLf & "Type: " & objEvent.Type
txt = txt &  vbCrLf & "User: " & objEvent.User
txt = txt &  vbCRLF & objEvent.Message & "<http://eventid.net/display.asp?eventid=" &objEvent.EventCode & "&source=" & objEvent.SourceName & "&Phase=1>" & vbcrlf & vbcrlf & vbcrlf
Next
 
 
if txt <> "" then
 
txt = "The Following Application Errors Have Occurred on : " & strComputer & vbcrlf & vbCRLF & txt 
 
else
Wscript.Quit(0)
end if
     
'This section provides the configuration information for the remote SMTP server.
     
ObjSendMail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2 'Send the message using the network (SMTP over the network).
ObjSendMail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpserver") ="##############"
ObjSendMail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 465 
ObjSendMail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpusessl") = True 'Use SSL for the connection (True or False)
ObjSendMail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout") = 60
     
' If your server requires outgoing authentication uncomment the lines bleow and use a valid email address and password.
ObjSendMail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpauthenticate") = 1 'basic (clear-text) authentication
ObjSendMail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/sendusername") ="#############"
ObjSendMail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/sendpassword") ="*****l"
     
ObjSendMail.Configuration.Fields.Update
     
'End remote SMTP server configuration section==
     
ObjSendMail.To = "you"
ObjSendMail.Subject = strComputer & "  Has encountered Application Errors"
ObjSendMail.From = strComputer & "########"
     
' we are sending a text email.. simply switch the comments around to send an html email instead
'ObjSendMail.HTMLBody = "this is the body"
ObjSendMail.TextBody = strComputer & chr(32) & txt
     
ObjSendMail.Send
     
Set ObjSendMail = Nothing 

Open in new window

0
 
Donald StewartNetwork AdministratorCommented:

example email that I get below
 
COMPUTER1 The Following System Errors Have Occurred on : COMPUTER1
 
Category: 0
Time: 04/21/2009 09:34.02
EventCode: 7000
Message: The tmcomm service failed to start due to the following error:
A device attached to the system is not functioning.
 
RecordNumber: 63
SourceName: Service Control Manager
Type: Error
User:
The tmcomm service failed to start due to the following error:
A device attached to the system is not functioning.
<http://eventid.net/display.asp?eventid=7000&source=Service Control Manager&Phase=1>
 
 
Category: 0
Time: 04/21/2009 09:34.02
EventCode: 7000
Message: The tmcomm service failed to start due to the following error:
A device attached to the system is not functioning.
 
RecordNumber: 62
SourceName: Service Control Manager
Type: Error
User:
The tmcomm service failed to start due to the following error:
A device attached to the system is not functioning.
<http://eventid.net/display.asp?eventid=7000&source=Service Control Manager&Phase=1>
 
 
Category: 0
Time: 04/21/2009 09:34.02
EventCode: 7000
Message: The tmcomm service failed to start due to the following error:
A device attached to the system is not functioning.
 
RecordNumber: 64
SourceName: Service Control Manager
Type: Error
User:
The tmcomm service failed to start due to the following error:
A device attached to the system is not functioning.
<http://eventid.net/display.asp?eventid=7000&source=Service Control Manager&Phase=1>
 
 
 
0
 
Donald StewartNetwork AdministratorCommented:
This is where I found the email script to modify to my own environment and needs
http://www.computerperformance.co.uk/Logon/VBScript/eventtriggers.htm 
0
 
markj72000Author Commented:
thanks for all the comments and replys, Wow you guys are fast.

dstewartjr:

I'm sort of a newbie to this could you give me some guidance as to how to implement that script. I am able to send thru my hosted smtp server. I have the port changed from 25 to 3535 but i have network printers that send notifications thru that server as well.

Mark
0
 
Donald StewartNetwork AdministratorCommented:
You will need to modify these lines:
16. to  'Application',  'System', etc..
44. Your smtp server
45.  smtp port
46. True for SSL False for no
51. username
52. password
58. Your email address
59. to match line 16
60. strComputer & "@yourdomain.com"
0
 
markj72000Author Commented:
Ok, i think i have all the edits made correctly. I'm assuming i save this as a .bat file but how to i make sure this is running all the time?

thanks again,

mark
0
 
Donald StewartNetwork AdministratorCommented:
you save this as a .vbs file
you then create your event trigger to call this
 
on your server run the following command
 
EventTriggers /create /TR "System" /l System /t ERROR /tk \\server\share\Systemmail.vbs  <<<< this path points to the vbs you saved above
0
 
Donald StewartNetwork AdministratorCommented:
Also after you create the eventtrigger the email will get sent every time you get a system error
0
 
markj72000Author Commented:
Is there a way to trigger this manually to test the script?

thanks,

Mark
0
 
Donald StewartNetwork AdministratorCommented:
edit the value MinutesToSearchWithin(line 7) to a higher number so that it finds an error and then either double click on it to run it, or you can also test the event trigger by going to scheduled tasks and running the task that looks similar to (System227960609)
0
 
Donald StewartNetwork AdministratorCommented:
Or try(temporarily for testing) changing line 16
("Select * from Win32_NTLogEvent Where Type = 'error'<<<this to 'information'
0
 
markj72000Author Commented:
Humm, well.. I'm not receiving any emails. I used my email information but perhaps i should setup a email address for the server that is sending the report.

Mark
0
 
Donald StewartNetwork AdministratorCommented:
Yeah it was kinda tricky getting the email part working for me as well.
0
 
Donald StewartNetwork AdministratorCommented:
This helped me figure it out
http://www.paulsadowski.com/WSH/cdo.htm 
0
 
markj72000Author Commented:
dstewartjr:

thanks for your help and patience, I had something persona come up and had to go out of town. I'll get back to work on this sometime this week and post back.

thanks for your patience,

Mark
0
 
Donald StewartNetwork AdministratorCommented:
Ok, no problem.
 
Good Luck
0
 
markj72000Author Commented:
dstewartjr:

I haven't been able to find time to get this to work but I should be able to figure it out with your provided info. If i run into any more troubles I'll open up another question. Thanks for your time and patience.

Mark
0
 
markj72000Author Commented:
Thanks again.

Mark
0

Featured Post

NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

  • 14
  • 7
  • 3
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now