create a custom log to track deletes on windows server 2003

Posted on 2009-12-18
Last Modified: 2012-05-08
Hi all,

Is there a way to create a vbscript or something that I can run every half hour or so to track only specific events, create a log file and put it in a specified directory?

For example, I would like to generate a log file that tracks deletes of any folder in a specific directory and which user deleted it. The event viewer can be a bit kludgy to work with.
Question by:binovpd
    LVL 31

    Expert Comment

    by:Henrik Johansson
    If enabled object auditing, it will be collected in security eventlog.
    As said, it can be a little bit hard to find stuff in event viewer...
    Use a custom view with filter to only display interesting data or use command line tools like Log Parser or dumpel.exe to dump eventlogs or forward the logs through third party syslogagent to a syslog server for log monitoring.
    With Log Parser, you can define a query with SQL/WQL-syntax to query for the interesting log records. It has a built-in template function making it possibly to create a HTML-file with the result for viewing.
    LVL 11

    Accepted Solution

    here is a script that will email you when a even occurs
    I use this to track a particular even on my servers

    strComputer = "."
    Set objWMIService = GetObject("winmgmts:" _
        & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
    ' you need to change here, for specific event logs you want to search. eg Application, Security etc
    Set colLoggedEvents = objWMIService.ExecQuery _
        ("Select * from Win32_NTLogEvent Where Logfile = 'Application' AND EventCode = '8226'")
    For Each objEvent in colLoggedEvents
          MSG = MSG & vbCrLf & _
                "Category: " & objEvent.Category & vbCrLf & _
                "Computer: " & objEvent.ComputerName & vbCrLf & _
                "Event Type: " & objEvent.Type & VbCrLf & _
                "Username: " & objEvent.User & vbCrLf
    Wscript.Echo MSG
    Set objFSO = CreateObject("Scripting.FileSystemObject")
    strMessageFile = Replace(WScript.ScriptFullName, WScript.ScriptName, "") & "MsgFile.txt"
    strBlatPath = Replace(WScript.ScriptFullName, WScript.ScriptName, "") & "Blat.exe"
    strRecipient = ""
    strSMTPServer = "SMTPServerName"
    strBlatPath = objFSO.GetFile(strBlatPath).ShortPath
    Set objOutputFile = objFSO.CreateTextFile(strMessageFile, True)
    objOutputFile.Write MSG
    Set objOutputFile = Nothing
    strMessageFile = objFSO.GetFile(strMessageFile).ShortPath
    strCommand = "cmd /c " & strBlatPath & " " & strMessageFile & " -to " & strRecipient & " -server " & strSMTPServer
    Set objShell = CreateObject("WScript.Shell")
    objShell.Run strCommand, 1, True

    Open in new window


    Author Closing Comment

    Sorry bfor the delay replying. this works well thank you.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    I had a question today where the user wanted to know how to delete an SSL Certificate, so I thought that I would quickly add this How to! Article for your reference. WHY WOULD YOU WANT TO DELETE A CERTIFICATE? 1. If an incorrect certificate was …
    Learn about cloud computing and its benefits for small business owners.
    This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
    This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    15 Experts available now in Live!

    Get 1:1 Help Now