How to set up email notification for Windows event log error?

I have Windows 2008 server. I want to set up an automatic email notification when an error alert occurred and posted in Windows event. How to set up this? Do you have a tutorial or screenshot to show how to do that
wasabi3689Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

motnahp00Commented:
eventvwr.msc -> select a specific event -> right click and select Attach Task to this Event -> Action (send an email)
0
wasabi3689Author Commented:
I want all kind of error events to send email AUTOMATICALLY. If I select a specific event then set it up, does it mean I only receive email for this kind error???
0
Acronis True Image 2019 just released!

Create a reliable backup. Make sure you always have dependable copies of your data so you can restore your entire system or individual files.

AnuroopsunddCommented:
actually all this puts command and you can play with this. use wildcard instead of specific eventid and you will get all event id's

wevtutil qe System "/q:*[System [(EventID=20274)]]" /f:text /rd:true /c:1
0
motnahp00Commented:
You will be receiving a spam attack with a configuration like that. Look into event log forwarding instead.
0
wasabi3689Author Commented:
@Anuroopsundd

Where to put to your
wevtutil qe System "/q:*[System [(EventID=20274)]]" /f:text /rd:true /c:1

Can you attach a screenshot? I want once an error occurs, the email is fired automatically. If no error, no email fired

@motnahp00
How this work? I don't find where event log forwarding is. Can you attach a screenshot?
0
AnuroopsunddCommented:
0
wasabi3689Author Commented:
Hi,

I don't understand this following

1.
>>Perfect, so that’s what I want emailed to me. So let’s create a quick batch file which will >>get the above information and put it in a file. I just called it query.cmd and saved it on >>my desktop for convenience (again, the wevtutil command is all on one line).

What should I put in to query.cmd?

2.
>>del %temp%\query.txt
>>wevtutil qe System "/q:*[System [(EventID=20274)]]" /f:text /rd:true /c:1 > >>%temp%\query.txt

Use command line to run above?

3. how to use wildcard to replace "(EventID=20274"
0
AnuroopsunddCommented:
wevtutil qe System "/q:*[System]" /f:text /rd:true /c:1 >%temp%\query.txt

above query will bring the last entry from system logs.

if you change /c:100 you will get last 100 entries.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
wasabi3689Author Commented:
Actually, I just need alert fired to my email once the error posted to event log. That means, if no error posted today, no need to send email, and if already sent out email alert for this instance, no need to send again. How to do that? I don't want to schedule the task to fire email everyday. I want to fire email only when error posted to event log. How to do that?
0
wasabi3689Author Commented:
Also, in the subject line, I want to pick up the source name with event ID

For example, Event 1009, DistributedCOM

How to do that?
0
wasabi3689Author Commented:
It sounds your command line only catches system log, I want to catch also application log and security log

wevtutil qe System "/q:*[System]" /f:text /rd:true /c:1 >%temp%\query.txt

When I catch System to Application, the email did not attach any thing, why?

wevtutil qe Application "/q:*[Application]" /f:text /rd:true /c:1 >%temp%\query.txt
0
wasabi3689Author Commented:
any comments for my questions?
0
wasabi3689Author Commented:
Hi,

I modified the script and I am able to capture both error thrown out from system and application.

Here is the script

Application error
del %temp%\application.txt
wevtutil qe Application "/q:*[System[(Level=1) or (Level=2)]]" /f:text /rd:true /c:1 >%temp%\application.txt

System Error
del %temp%\system.txt
wevtutil qe System "/q:*[System[(Level=1) or (Level=2)]]" /f:text /rd:true /c:1 >%temp%\system.txt

But, I still have an issue. The error email notification fired every night. Actually, I want them to fire only there error occurs. If no error occurs, no email fired. If error notification already fired, don't fire again.

How to do this and change the code.
0
wasabi3689Author Commented:
All ideas are very helpful here
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.