John Howard - Senior Program Manager in the Hyper-V team at Microsoft

Senior Program Manager, Hyper-V team, Windows Core Operating System Division.

Getting event log contents by email on an event log trigger

Getting event log contents by email on an event log trigger

  • Comments 46
  • Likes

This one was actually pretty simple to work out, but it did have me flummoxed to start with. Here’s the scenario, I wanted to get an email when an event log entry was triggered. But, I also wanted the contents of the event log entry. I’ve been meaning to document this for ages, but never seem to find the time!

So here’s an example of the in-box functionality vs. a simple bit of bolt-on customization. In this example, I’ll use Event 20274 for RemoteAccess on a Windows Server 2008 R2 box running TMG 2010. This particular event is logged when an inbound VPN connection is established, and the body of the message says who connected, on what port, and what IP address they have been allocated.

First, inbox functionality. Establish the VPN, and find the event in the event log.

RAS1

Down in the bottom right, choose “Attach Task To This Event….”, and walk through the wizard. On the first screen, give it an appropriate name such as “A user connected through VPN”. On the action page, select send an email. On the Send an email page, fill in the appropriate information for From/To/Subject/Text and SMTP Server. What you’ll notice is that there’s nowhere to specify what goes in the body. But you can include a static attachment, but that doesn’t serve our needs

RAS2
Finish the wizard, and connect again through VPN to see what email comes through. Not particularly useful. Not yet, anyway.

RAS3

Now if you go into task scheduler, and drill down through Task Scheduler Library then to Event Viewer Tasks, you’ll see a new item. If you go into the properties of the task, you’ll see there’s no way to include the text of the event log in the message.

So step back a second, and ask “what’s the easiest way to get the last instance of event 20274 firing in the System event log?”. The answer (or an answer) is wevtutil. Here’s a command that will do that (note all on one line):

wevtutil qe System "/q:*[System [(EventID=20274)]]" /f:text /rd:true /c:1

Running that in a command prompt will yield the following:

ras4
Perfect, so that’s what I want emailed to me. So let’s create a quick batch file which will get the above information and put it in a file. I just called it query.cmd and saved it on my desktop for convenience (again, the wevtutil command is all on one line).

del %temp%\query.txt
wevtutil qe System "/q:*[System [(EventID=20274)]]" /f:text /rd:true /c:1 > %temp%\query.txt

With that done, let’s revisit the properties of the task and look at the Actions tab. Let’s add an item to run this batch file, and put it top of the list.

ras5
Now we need to look at the properties of the “Send an e-mail” option. Remember there was an “Attachment” setting. Well conveniently, we have a file which contains the information we need, %temp%\query.txt now. Simply put “C:\Users\tmgadmin\AppData\Local\Temp\query.txt” in that box. (Obviously replace the username/location as appropriate). I’m also going to remove the body of the message.

So what does the email look like now if I establish a VPN?

ras6
Exactly what I wanted! Hope that helps someone.

(And before you ask, the only link this post has to Hyper-V is that my TMG and Email servers are Hyper-V VMs).

Cheers,
John.

PS – yes, I realize this may not be perfect if two users connect at exactly the same time, or in your use case that multiple events fire at the same time, but I’ll leave that as an exercise for the reader to solve :)

Comments
  • Nice. Will give it a shot :)

    Is it possible to generate an email on every "warning" or "error" message without specifying the Event ID? That would save time to monitor and filter the events of Hyper-V R2 without going through MOM and sending emails through MOM. Currently my MOM sends email alerts for Forefront only.

  • Yadunandan - not my area of expertise, but it doesn't appear that this is possible.

    Thanks,

    John.

  • This is a great way to get the information you need.

    I do have a question...In the screen shot you have above, the text from the event log appears to be inside the E-Mail, however when following the steps outlined, it arrives as an attachment rather than in the message body.  Did I miss a step somewhere?

  • Robert - you are correct. However Outlook 2010 displays text attachments if there is an empty email body in this way.

    Thanks,

    John.

  • I've been trying this but do not get any email. Does this require that SMTP be loaded on the event server in order to send it? The event history shows that it launched OK.

  • James - not in my case. I have a seperate Exchange machine which I'm using as the target.

  • John this has been working perfect for me, thanks so much!

    Starting today the text attachment no longer shows so conveniently in the body with OL2010. Is that in your case too? Maybe that security windows update overnight killed that feature...

  • You can achieve this for a set of tasks by creating a custom view (in Win2008), I believe - just right click on subscriptions in event viewer, create a custom view and then select the custom view and attach a task to it as above.

  • Thanks John, works great on Windows 7. What is the equivalent of wevtutil in Windows XP?

  • is there any way to get contents of the event log in the text of the email without running any script ?

  • Steven - sorry, not sure on that one. If wevtutil isn't inbox, I don't have an answer. has been waaay too long since I've used XP :)

  • Tejas - I haven't been able to do this using the mechanism above. You could probably rather than use the send email action, start another script which sends an email manually using something like CDO. Not something I've investigated though.

  • Thanks for the ideas.  I can't believe that SBS 2011 doesn't have something that was a few click in SBS 2003 - so far this is the first thing with SBS 2011 I am completly un-impressed with.  SBS 2003 had much better built-in alert monitoring.  I'm still hoping I'm just missing something obvious...

  • Thanks for this post. I have followed the above steps and mails are sending successfully.

    But the text file is sending as an attachment. It doesn't appear in message body. I am using outlook 2010.

    Is it possible to send the email as plain text instead of html?

    Thanks.

  • Hi,

    I have the same problem , ia m already using the mail attachement but i dnt want in attachment any more. i want that in mail body. could any one please hlp me

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment