Search WWW Search

Friday, September 01, 2006

Exchange: Event Monitoring Via WMI (Backup Report)


In this article, I will provide a sample script to monitor event IDs and email the event to the specified email address. This sample code implements the use of WMI quering the Win32_NTLogEvent class for event ID 213. Event ID Source ESE 213 indicates the completion of Exchange Backups. If you do not see Event ID 213, you may be using a third party backup application that does not use the Exchange backup API. If this is the case, you will need to identify the event ID that your third party application uses.

The script will email out so you will need to specify your SMTP server in this script.

Note: You can use built in Windows command eventcreate.exe to simulate event to test.

Event ID 213
Information Store (4168) TEST.NET: The backup procedure has been successfully completed.

1. Modify the portion of the script to specify the source and destination email addresses to send from and to.

2. Copy the contents below and name the file eventmon.vbs

3. Double Click the file. It will continously monitor for the event 213. Therefore you will see wscript process running in task manager process tab. To terminate the job, click end task.

Note: You can download this file from[ James Chong Scripts ]

set objEmail = CreateObject("CDO.Message")

'strComputer=Inputbox("Enter the computer name you want to monitor")
'if strcomputer="" then
strComputer = "."
'end if

set objwmiservice=getobject("winmgmts://" &strcomputer &"/root/cimv2")

strwql="select * " & _
"from __instancecreationevent " & _
"where targetinstance isa 'Win32_NTLogEvent' " & _
"and targetinstance.eventcode = '213' "

set objeventsource=objwmiservice.execnotificationquery(strwql)

wscript.echo "waiting for an event to happen on " &strcomputer

While True
set objeventobject=objeventsource.nextevent()
objEmail.Subject = objEventobject.TargetInstance.ComputerName & _
objEventobject.TargetInstance.logfile & "\" & _
objEmail.From = ""
objEmail.To = ""

objEmail.Textbody = "Computer Name: " & _
objEventobject.TargetInstance.ComputerName & _
"Notification E-Mail from Automated windows event monitoring script." & vbcrlf _
& " Event Type: " & objEventobject.TargetInstance.type & vbcrlf _
& " Event ID: " & objEventobject.TargetInstance.eventcode &vbcrlf _
& " Event source: " & objEventobject.TargetInstance.sourcename & vbcrlf _
& " Event Log: " & objEventobject.TargetInstance.logfile & vbcrlf _
& " Event Time: " & objEventobject.TargetInstance.timewritten & vbcrlf _
& "The Event Err details are :- " & vbcrlf _
& objEventobject.TargetInstance.Message

'==This section provides the configuration information for the remote SMTP server.
'==Normally you will only change the server name or IP.
objemail.Configuration.Fields.Item _
("") = 2

'Name or IP of Remote SMTP Server
objemail.Configuration.Fields.Item _
("") = ""

'Server port (typically 25)
objemail.Configuration.Fields.Item _
("") = 25


'==End remote SMTP server configuration section==



James Chong
MCSE M+, S+, MCTS, Security+

How useful was this article? Want to see a tip not listed? Please leave a comment.


Anonymous brijraj said...

Hi James,
It was indeed a vital post for me, i am looking forward to monitor all the incoming msgs at an exchange server 2003, and do something with the msgs for which recepients are not available.

any quick views? i'll appreciate.

thanks and regards


12:19 AM  
Anonymous Alex said...

On as regards backup i know little,but restore-convert a microsoft exchange .ost to .pst,may program for Exchange recovery ost was made to recover Exchange with ost files Outlook 2003,allows to recover all files separately: *.eml, *.vcf and *.txt files will be extracted and placed in the same folder,program is based on effective *.ost files recovery technology, that allows easily convert them to *.pst files, that can be opened by any mail client, compatible with Microsoft Outlook.

4:49 AM  
Anonymous Anonymous said...

For many people, the first type of Men’ Footwear that we believe that during the consideration of Hogan scarpe for men in May of tennis shoes or even a generic cross-training shoes. For others, they believe in May of Hogan scarpe donna , it depends on your background. In fact, this category of hogan donna covers a wide range of sports shoes and leisure activities ranging from golf and basketball and soccer shoes race. I tend to buy Hogan scarpe uomo against training only because I am involved in a wide range of sports and weightlifting, the race to play basketball.

5:21 PM  
Blogger dong dong said...

christian louboutin
oakley sunglasses cheap
christian louboutin outlet
hollister clothing store
ray ban outlet
louis vuitton outlet stores
christian louboutin sale
michael kors bag
cheap lululemon
michael kors outlet online sale
true religion outlet
coco chanel
michael kors handbags
ray ban glasses
red christian louboutin
louis vuitton handbags
michael kors outlet online
coach outlet store online
rolex watches outlet
celine outlet
ray ban sunglasses
cheap jordans
coach factory outlet
jordan 13
hollister clothing
tory burch outlet online
oakley vault
jordan shoes
mont blanc
toms outlet
nfl jerseys

12:38 AM  

Post a Comment

<< Home

xml:lang="en" lang="en"> MS Exchange Tips: Exchange: Event Monitoring Via WMI (Backup Report)