How can I monitor my historic windows events?

Accepted Answer

Votes:

5

The following sensor will search multiple event logs from multiple providers. You can search for IDs and the message text. Make sure you read the synopsis of the sensor to get an idea of what the specific parameters do. Please use the following script with an EXE/Script sensor:

Note: Newer PRTG versions require a different parameter setup. Please check the following reply.

#___ ___ _____ ___
#| _ \ _ \_   _/ __|
#|  _/   / | || (_ |
#|_| |_|_\ |_| \___|
#    NETWORK MONITOR
#-------------------
#(c) 2015 Stephan Linke, Paessler AG
#
# Name: PRTG-Get-WinEvents
# Description: Reads the windows eventlog and filters for the specific events
# 
# Version History
# ----------------------------
# Version Date        Description 
# 1.1     07/12/2016  [Fixed] If only one event existed, the sensor showed no events
# 1.0     19/05/2014  Initial Release 
<#
   .SYNOPSIS
   Reads the windows eventlog and filters for the specified events.
   .DESCRIPTION
   This custom sensor for PRTG will read the given EventLog file and search it
   for the defined events. It also allows to error if the last event found has a certain ID or
   Message.
   .PARAMETER ComputerName
   The computer whose event log you want to check
   .PARAMETER Channel
   The log name that is used by the application 
   .PARAMETER ProviderName
   The application that you want to watch
   .PARAMETER EventID
   The event IDs you want to filter. Seperate multiple IDs with comma
   .PARAMETER WarningEvents
   The event IDs you want to raise a warning when found. Those IDs also have to be included in the event ids
   .PARAMETER ErrorEvents
   The event IDs you want to raise a error when found. Those IDs also have to be included in the event ids
   .Parameter Levels
   The Loglevels you want to include in the search
   .PARAMETER MaxAge
   The age of the Logfile in hours
   .PARAMETER LimitEntries
   Maximum number of log entries to be checked (order is new -> old)
   .PARAMETER WarningStrings
   Put the sensor into a warning state when a certain string is found within the message
   .PARAMETER ErrorStrings
   Put the sensor into a error state when a certain string is found within the message
   .PARAMETER StateBasedOnLastID
   If this parameter is set, not the sheer number of events will decide if the sensor will go into error or warning state,
   but only the event id of the last entry found. This is useful for RAID controllers, etc.
   .PARAMETER StateBasedOnLastMessage
   If this parameter is set, not the sheer number of events will decide if the sensor will go into error or warning state,
   but only the message of the last entry found. This is useful if messages have the same event ID for errors and information events.
    
   .PARAMETER Username and Password
   The username and password that the script should use to create the credential object.
   Format -Username "domain\username" -Password 'yourpass'
   .OUTPUTS
   <number of entries found>:<entries> found in the event log. Last message: <last entry message>
   .EXAMPLE
   C:\PS> .\Get-Events.ps1  -ComputerName %host -Username "%windowsdomain\%windowsuser" -Password "%windowspassword" -ProviderName "Microsoft-Windows-Immersive-Shell" -Channel "Microsoft-Windows-TWinUI/Operational" -LimitEntries 1 -MaxAge 1 -EventID 1719 -Level 4
   .EXAMPLE
   C:\PS> .\Get-Events.ps1  -ComputerName %host -Username "%windowsdomain\%windowsuser" -Password "%windowspassword" -ProviderName "Microsoft-Windows-Immersive-Shell" -Channel "Microsoft-Windows-TWinUI/Operational" -LimitEntries 1 -MaxAge 1 -EventID 1719 -Level 4 -StateBasedOnLastEntry
#>

param(
    [string]$ComputerName     = "Percy",
    [string[]]$Channel        = @("PRTG Network Monitor"),
    [string[]]$ProviderName   = @("PRTG Network Monitor"),
    [int[]]$EventID           = @(2),
    [int[]]$WarningEvents     = @(),
    [int[]]$ErrorEvents       = @(),
    [string[]]$ErrorStrings   = @(),
    [string[]]$WarningStrings = @(),
    [int[]]$Levels            = @(),
    [float]$MaxAge            = 24,
    [int]$LimitEntries        = 100,
    # empty credentials, in case we run at localhost.
    [string]$Username       = '',
    [string]$Password       = '',
    [switch]$AlwaysShowMessage = $true,
    [switch]$StateBasedOnLastMessage = $true,
    [switch]$StateBasedOnLastEventID = $true

)
[System.Threading.Thread]::CurrentThread.CurrentCulture = New-Object "System.Globalization.CultureInfo" "en-US"
[switch]$Verbose = $false

# This will return an error and exit accordingly
# If there's an error, only this will be outputted
#######################################
function This-PrtgResult([int]$Value = 0, [string]$Message,[int]$ExitCode){

    if(!($verbose)){ 
        Write-Host ([string]::Format("{0}:{1}",$Value,$Message));
        exit $ExitCode;
    }
    else 
    { Write-Host ([string]::Format("{0}:{1}",$Value,$Message)); }

}

# This will create the credential
# object that is used to get the events
#######################################
function This-GenerateCredentials(){

    # Generate Credentials if we're not checking localhost
    if((($env:COMPUTERNAME) -ne $ComputerName)){
        # Generate Credentials Object first
        $SecPasswd  = ConvertTo-SecureString $Password -AsPlainText -Force
        $Credentials= New-Object System.Management.Automation.PSCredential ($Username, $secpasswd)
        return $Credentials
    }

    # otherwise return false
    else{ return "false" }
}  

# This will retrieve the event log entries
# based on channel, provider and events ID.
#######################################
function This-ReadEventLog(){

    $Credentials = (This-GenerateCredentials);
    $EventFilter = @{};
    
    # Filter the objects according to their timestamp
    $EventFilter.Add("StartTime",(get-date).AddHours(-$MaxAge));

    # We need a provider, otherwise the script will error if none is given. 
    # If it's set, it'll be added to the filter  
    if($ProviderName.Count -eq 0)
    { This-PrtgResult -Message "No ProviderName given. Please enter a valid Provider." -ExitCode 1; }
    
    $EventFilter.Add('ProviderName',$ProviderName)
    
    # We need a Channel, otherwise the script will error if none is given. 
    # If it's set, it'll be added to the filter    
    if($Channel.Count -eq 0)
    { This-PrtgResult -Message "No Channel given. Please enter a valid Provider." -ExitCode 1;  }
    
    $EventFilter.Add("LogName",$Channel)  

    # If there are event IDs, add them to the filter
    if($EventID.Count -gt 0)
    { $EventFilter.Add("ID",$EventID); }

    # if there are levels, add them to the filter
    if($Levels.Count -gt 0)
    { $EventFilter.Add("Level",$Levels) }

    try{
        if($Credentials -ne "false"){ $Events = (Get-WinEvent -ComputerName $ComputerName -FilterHashTable $EventFilter -MaxEvents $LimitEntries -Credential $Credentials) }
        else                        { $Events = (Get-WinEvent -ComputerName $ComputerName -FilterHashTable $EventFilter -MaxEvents $LimitEntries ) }
     
        return $Events;
    }
    catch [Exception]
    { This-PrtgResult -Message ([string]::Format("Can't find anything for {0} in your {1} eventlog. Please check Log name, Provider, Log ID, EventID, ComputerName and Credentials",$ProviderName -join " or ",$Channel -join " or ")) -ExitCode 1 }

}
# This will evaluate the results from the above
# function and return the sensor value
#######################################
function This-EvaluateLogResults(){
         
        $Events = (This-ReadEventLog);
        $Counter = $Events.Count

        # We need the events to be in an array, even if we only have one value
        # This makes iterating easier.
        $Events = @($Events); 
  
        if($Counter -gt 0){ 

            $EventList = [System.Collections.ArrayList]$Events
           
            # Always show the last message when enabled
            if(($AlwaysShowMessage) -and ($Counter -ne 0)){
                if(!([string]::IsNullOrEmpty($EventList[0].Message))){
                 $LastMessage = ($EventList[0].Message.Remove(50)+"..." -replace "`n|`r")
                 $Message = "(Last entry: "+$LastMessage+")"
                }
            else
            { $Message = "(Latest event has no message)"; }
            }
                 
            # Search for error and warning IDs
            if((($StateBasedOnLastEventID)) -and (-not($StateBasedOnLastMessage))){
                switch ($EventList[0].Id){
                    {$ErrorEvents -contains $EventList[0].Id}  { This-PrtgResult -Message "Critical Event found: $($Message)" -Value $Counter -ExitCode 1 }
                    {$WarningEvents -contains $EventList[0].Id}{ This-PrtgResult -Message "Warning Event found: $($Message)" -Value $Counter -ExitCode 1 }
                }
            }
         
            # Search for messages that contain the error and warning strings
            elseif(($Counter -ne 0) -and ($StateBasedOnLastMessage)){
            foreach($String in $ErrorStrings){
                        if($EventList[0].Message -match "($String)"){ This-PrtgResult -Message "Critical Event found: $($Message)" -Value $Counter -ExitCode 1 } }
                    foreach($String in $WarningStrings){
                        if($EventList[0].Message -match "($String)"){ This-PrtgResult -Message "Warning Event found: $($Message)" -Value $Counter -ExitCode 1 } }
            }
     
            # Search for messages that contain the error and warning strings and the messages
            elseif(($Counter -ne 0) -and (($StateBasedOnLastMessage) -and ($StateBasedOnLastID))){
            switch ($EventList[0].Id){
                        {($ErrorEvents -contains $EventList[0].Id) -and ($EventList[0].Message -match $ErrorStrings)}     { This-PrtgResult -Message "Critical Event found: $($Message)" -Value $Counter -ExitCode 1}
                        {($WarningEvents -contains $EventList[0].Id) -and ($EventList[0].Message -match $WarningStrings)} { This-PrtgResult -Message "Warning Event found: $($Message)" -Value $Counter -ExitCode 1}
                    }
            }

        }
        switch ($Counter){
                {$Counter -eq 0}{ This-PrtgResult -Message "No events found." -ExitCode 0 }
                {$Counter -ge 1}{ This-PrtgResult -Message "$($Counter) event(s) found $($Message)." -Value $Counter -ExitCode 0 }
        }
             
}

This-EvaluateLogResults;

In order to get detailed information about the event you want to monitor, please open the Windows Event Viewer application, search for the event and switch to the detail tab. Select the XML view to see all properties of the event.

Parameter example:

-ComputerName %host -Username "%windowsdomain\%windowsuser" -Password "%windowspassword" -MaxAge 8 -Channel 'Application' -ProviderName 'ESENT' -EventID @(105,200,301) -WarningEvents @(200) -ErrorEvents @(301) -AlwaysShowLastMessage

The % variables will be replaced automatically by PRTG. If you want to look for multiple event IDs, strings, logs and providers, simply add them to the array:
IDs @(101,102,103,104)
Events, Strings @("String 1","String 2")

If you want to work with channel limits instead of the hardcoded limits (0 = green, 1 = warning, 2 and above = error), edit the lines 155 and 156, specifically the exit code.

Important The user you use needs to have administrative privileges on the target device; he can't read the events as a normal user.

What is this?

Top Tags

How can I monitor my historic windows events?

1

5

0

1

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

1

0

0

0

0

0

0

0

0

0

0

0

0