Exchange: Event Monitoring Via WMI (Backup Report)

Summary:

In this article, I will provide a sample script to monitor event IDs and email the event to the specified email address. This sample code implements the use of WMI quering the Win32_NTLogEvent class for event ID 213. Event ID Source ESE 213 indicates the completion of Exchange Backups. If you do not see Event ID 213, you may be using a third party backup application that does not use the Exchange backup API. If this is the case, you will need to identify the event ID that your third party application uses.

The script will email out so you will need to specify your SMTP server in this script.

Note: You can use built in Windows command eventcreate.exe to simulate event to test.

Event ID 213
Information Store (4168) TEST.NET: The backup procedure has been successfully completed.



1. Modify the portion of the script to specify the source and destination email addresses to send from and to.

2. Copy the contents below and name the file eventmon.vbs

3. Double Click the file. It will continously monitor for the event 213. Therefore you will see wscript process running in task manager process tab. To terminate the job, click end task.

Note: You can download this file from ftp://ftp.smtp25.org/[ James Chong Scripts ]

set objEmail = CreateObject("CDO.Message")

'strComputer=Inputbox("Enter the computer name you want to monitor")
'if strcomputer="" then
strComputer = "."
'end if

set objwmiservice=getobject("winmgmts://" &strcomputer &"/root/cimv2")

strwql="select * " & _
"from __instancecreationevent " & _
"where targetinstance isa 'Win32_NTLogEvent' " & _
"and targetinstance.eventcode = '213' "

set objeventsource=objwmiservice.execnotificationquery(strwql)

wscript.echo "waiting for an event to happen on " &strcomputer

While True
set objeventobject=objeventsource.nextevent()
objEmail.Subject = objEventobject.TargetInstance.ComputerName & _
objEventobject.TargetInstance.logfile & "\" & _
objEventobject.TargetInstance.sourcename
objEmail.From = "admin@mydomain.com"
objEmail.To = "admins@mydomain.com"



objEmail.Textbody = "Computer Name: " & _
objEventobject.TargetInstance.ComputerName & _
"Notification E-Mail from Automated windows event monitoring script." & vbcrlf _
& " Event Type: " & objEventobject.TargetInstance.type & vbcrlf _
& " Event ID: " & objEventobject.TargetInstance.eventcode &vbcrlf _
& " Event source: " & objEventobject.TargetInstance.sourcename & vbcrlf _
& " Event Log: " & objEventobject.TargetInstance.logfile & vbcrlf _
& " Event Time: " & objEventobject.TargetInstance.timewritten & vbcrlf _
& "The Event Err details are :- " & vbcrlf _
& objEventobject.TargetInstance.Message

'==This section provides the configuration information for the remote SMTP server.
'==Normally you will only change the server name or IP.
objemail.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2

'Name or IP of Remote SMTP Server
objemail.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "mail.mydomain.com"

'Server port (typically 25)
objemail.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25

objemail.Configuration.Fields.Update

'==End remote SMTP server configuration section==



objEmail.Send

Wend





James Chong
MCSE M+, S+, MCTS, Security+
msexchangetips.blogspot.com


How useful was this article? Want to see a tip not listed? Please leave a comment.