My Windows file server doesn’t act up that much so it is easy to put checking the event logs on the back burner. So far back that when something does go wrong it takes a catastrophic failure and a few calls from the Dean’s Office to get it taken care of.
Nuts to that! Windows 2008 server comes with elaborate web based monitoring configurations that allow the savvy admin to check all sorts of bells and whistles. Dell also has OpenManage software that works (with varying degrees of success) and adds some more glitz and glamor.
But this server is a plain old workhorse that doesn’t need glamor and bells. I just want to have the server give me a notice when an error pops up in the event log for either System, Application, or Security. Why not use EVENTTRIGGERS?
That’s what I said! So I started using them. They are quite simple and combined with bmail the server can email me my alerts with a minimum of overhead and space taken up.
An EVENTTRIGGERS is invoked in a DOS shell and monitors the log you want to monitor for the conditions you want to keep track of, and executes a command when that condition is met.
@eventtriggers /create /tr SYSTEMERROR /l System /t Error
/tk c:\windows\system\events\systemerrors.bat
The above command tells EVENTTRIGGERS to create a new trigger called SYSTEMERROR, to monitor the system log for the type ERROR and to execute the command when an ERROR is found.
SYSTEMERRORS.BAT
@ECHO OFF
@echo Here are the last 4 error entries from SYSTEM log >systemerrors.msg
@eventquery /l system /r 4 /fi "Type eq Error" /v >>systemerrors.msg
@BMAIL.exe -s {smtpserver} -t {destination email address} -f [who it's from] -h
-a "System Event Log Error Detected" -m systemerrors.msg -c >NUL
Uses the EVENTQUERY.VBS file to get the last 4 errors from the event log and adds them to a .MSG file and emails that file using the BMAIL.EXE program (available on the web).
A trigger for each event log is made and a separate batch file as well.
Now, when something goes BUMP in the night on the server it can drop me a note to alert me.