Getting event log contents by email on an event log trigger

re: Getting event log contents by email on an event log trigger

Jason — Fri, 17 May 2013 17:39:49 GMT

I'm querying the :

Microsoft-Windows-Small Business Server_Operational_Windows Small Business Server 2011 Standard

Log for failures in the POP3 connector (event 212), but I can't seem to fashion an alternative command to search through a Log that has a space in the name.

re: Getting event log contents by email on an event log trigger

Chinnu — Tue, 14 May 2013 15:13:30 GMT

Hello,

How can we get the details of the error in an email.

When I say attach task to the event and fill in the details , we do not get the details of the error message.

We just get the text saying "text" ...How can we get the inner details of the error.

I have an application and whenever an error is thrown in that application , an email should be triggered so that the inner details of the exception should also be triggered within the email. How can this be done..Do we need to run the batch file for getting the inner exception as well ?

re: Getting event log contents by email on an event log trigger

Mike — Tue, 16 Apr 2013 14:48:15 GMT

I know these are old... but for others searching who may not have found the answers:

@u2_boy

try: wevtutil qe Application "/q:*[System[(EventID=28673)]]" /f:text /rd:true /c:1

I was having similar problems. the answer I found (for server 2012) was to apply filter in the event viewer and then copy the query out of the XML tab for the command line. (but not the xml pieces)

for example: in my case I wanted to know the last deduplication result the xml line was:

<Select Path="Microsoft-Windows-Deduplication/Operational">*[System[(EventID=6153)]]</Select>

my command then became:

wevtutil qe Microsoft-Windows-Deduplication/Operational "/q:*[System[(EventID=6153)]]" /f:text /rd:true /c:1

the query section appears to be case and spacing sensitive.

@Max

change your /rd:false to /rd:true (true sorts by most recent events)

re: Getting event log contents by email on an event log trigger

lg — Mon, 08 Apr 2013 14:45:27 GMT

figured it out.

it was not running elevated

re: Getting event log contents by email on an event log trigger

Max — Tue, 29 Jan 2013 15:18:38 GMT

Hi,

this shows always an old event entry not the last event.

wevtutil qe System "/q:*[System [(EventID=1116)]]" /f:text /rd:false /c:1 >C:\Temp\myfile.txt

for example the event 1116 comes up more then one time a day i will send only the last event but i receive always an old event from yesterday or older

re: Getting event log contents by email on an event log trigger

sluisejuice — Thu, 10 Jan 2013 05:27:56 GMT

Hi All,

Its relatively easy to make it a bit cleaner by creating a powershell (or vbscript) script to run wevtutil to create a file with the event info, then parse the file into an email's body, and send it. No attachment required that way. And you would only need one action "start a program" that would call your script.

re: Getting event log contents by email on an event log trigger

Zeeshan Ibrahim — Tue, 11 Dec 2012 11:38:45 GMT

dear i m also facing a prblm...i m not receiving any email on any event. even i have configure that..what can be the reason?

re: Getting event log contents by email on an event log trigger

Zeeshan Ibrahim — Tue, 11 Dec 2012 11:15:46 GMT

Exactly ,,,,that is what i needed..i just need this for event "4663", i will try and will let u know if succeded.....Thanks buddy

re: Getting event log contents by email on an event log trigger

Horinius — Mon, 29 Oct 2012 15:10:56 GMT

I'm trying to make the server send me a mail on O/S reboot. I tried to attach the task to "System, Event ID: 6005" but the mail is never sent. I suppose that's because network is not yet ready at the moment event 6005 is generated. Is there any solution with this "event-attached task" trick? Thanks in advance.

re: Getting event log contents by email on an event log trigger

T. Kennis — Wed, 17 Oct 2012 10:19:50 GMT

Very nice solution.

There is an alternative, if you don't want an external program to collect the information.

Export your scheduled task to XML, change the XML by querying the values you need, re-import your task and use the parameters as arguments for the action.

more information: www.buit.org/.../event-based-triggered-tasks