Link to home
Start Free TrialLog in
Avatar of Member_2_6492660_1
Member_2_6492660_1Flag for United States of America

asked on

BGINFO Shutdown Reason

I run a script everytime my Windows 2003 Servers start that run bginfo and puts the information on the desktop.

Works great on Windows 2003 and Windows 2008 Servers.

I would like to add a field to the display to show the reason for the last shutdown.

Example I had a Power outage today and my UPS's units keep the servers up but shutdown after a long outage. The all shutdown normally except for one. When that one came back online it presented me with a reason for shutdown screen where I entered trouble number and description.

Would like that info to be displayed using bginfo.

Any one have a script that can do this?
Avatar of Maeros
Maeros
Flag of Canada image

It'll be a bit tricky, so you'll have to fiddle a bit.  Info from last shutdown is stored in the event log, so you'll have to set up a Custom field to display the event log info.  To do that, press Custom... and select WMI Query.  Try using Win32_NTLogEvent, that'll get you access to the event log.  From there, you'll have to isolate what you want to show (and not show), which I would recommend experimenting with until you get what you want (depending on your preference as to too much or too little).
Avatar of Member_2_6492660_1

ASKER

Hi thanks for the input

Was hoping for a script to do this

Anyone have an example of a script?
Avatar of Lucian Constantin
Create a custom variable in BGInfo and attach to it the following VBScript:

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate,(Security)}!\\" & _
        strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTLogEvent " _
        & "Where LogFile='System' and SourceName='user32'")
For Each objLogFile In colLogFiles
    Echo objLogFile.Message
    Exit For
Next

Open in new window


An see if will return the expected result.
I ran this

C:\Temp>cscript test.vbs
Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation. All rights reserved.

C:\Temp\test.vbs(9, 5) Microsoft VBScript runtime error: Type mismatch: 'Echo'

also should we refine this to the event messages 1076 and 1074  if so how?
To see the results when running with cscript you shoud modify the line:

Echo objLogFile.Message

to display:

Wscript.Echo objLogFile.Message


But shoud remain simply echo when running in BGInfo.

To include both event codes use the following script:

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate,(Security)}!\\" & _
        strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTLogEvent " _
        & "Where LogFile='System' and SourceName='user32' and (EventCode='1074' or EventCode='1076')")
For Each objLogFile In colLogFiles
    wscript.Echo objLogFile.Message
    Exit For
Next

Open in new window

Luconsta

Thanks that works great.

Is there anyway to only display

Reason Code
Shutdown Type
Comment

Really do not need the description field

see below

Here is the event 1074

Log Name:      System
Source:        USER32
Date:          7/12/2013 1:41:42 PM
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:         PC01\Test
Computer:      TB-07182012
Description:
The process C:\Windows\system32\winlogon.exe (PC01) has initiated the restart of computer PC01 on behalf of user PC01\Test for the following reason: No title for this reason could be found
 Reason Code: 0x500ff
 Shutdown Type: restart
 Comment:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="USER32" />
    <EventID Qualifiers="32768">1074</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-07-12T17:41:42.000000000Z" />
    <EventRecordID>80923</EventRecordID>
    <Channel>System</Channel>
    <Computer>PC01\Test</Computer>
    <Security UserID="S-1-5-21-2327774470-480063297-2363401449-1000" />
  </System>
  <EventData>
    <Data>C:\Windows\system32\winlogon.exe (PC01\Test)</Data>
    <Data>PC01\Test</Data>
    <Data>No title for this reason could be found</Data>
    <Data>0x500ff</Data>
    <Data>restart</Data>
    <Data>
    </Data>
    <Data>PC01\Test</Data>
    <Binary>FF000500000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>
ASKER CERTIFIED SOLUTION
Avatar of Lucian Constantin
Lucian Constantin
Flag of Romania image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Script works great thanks
luconsta

can you look at this one for me?

It is part of this one but I created another question for it

https://www.experts-exchange.com/questions/28189036/VBS-Script-help-needed.html

Thanks