Google
Search WWW Search msexchangetips.blogspot.com

Friday, September 01, 2006

Exchange: Event Monitoring Via WMI (Backup Report)

Summary:

In this article, I will provide a sample script to monitor event IDs and email the event to the specified email address. This sample code implements the use of WMI quering the Win32_NTLogEvent class for event ID 213. Event ID Source ESE 213 indicates the completion of Exchange Backups. If you do not see Event ID 213, you may be using a third party backup application that does not use the Exchange backup API. If this is the case, you will need to identify the event ID that your third party application uses.

The script will email out so you will need to specify your SMTP server in this script.

Note: You can use built in Windows command eventcreate.exe to simulate event to test.

Event ID 213
Information Store (4168) TEST.NET: The backup procedure has been successfully completed.



1. Modify the portion of the script to specify the source and destination email addresses to send from and to.

2. Copy the contents below and name the file eventmon.vbs

3. Double Click the file. It will continously monitor for the event 213. Therefore you will see wscript process running in task manager process tab. To terminate the job, click end task.

Note: You can download this file from ftp://ftp.smtp25.org/[ James Chong Scripts ]

set objEmail = CreateObject("CDO.Message")

'strComputer=Inputbox("Enter the computer name you want to monitor")
'if strcomputer="" then
strComputer = "."
'end if

set objwmiservice=getobject("winmgmts://" &strcomputer &"/root/cimv2")

strwql="select * " & _
"from __instancecreationevent " & _
"where targetinstance isa 'Win32_NTLogEvent' " & _
"and targetinstance.eventcode = '213' "

set objeventsource=objwmiservice.execnotificationquery(strwql)

wscript.echo "waiting for an event to happen on " &strcomputer

While True
set objeventobject=objeventsource.nextevent()
objEmail.Subject = objEventobject.TargetInstance.ComputerName & _
objEventobject.TargetInstance.logfile & "\" & _
objEventobject.TargetInstance.sourcename
objEmail.From = "admin@mydomain.com"
objEmail.To = "admins@mydomain.com"



objEmail.Textbody = "Computer Name: " & _
objEventobject.TargetInstance.ComputerName & _
"Notification E-Mail from Automated windows event monitoring script." & vbcrlf _
& " Event Type: " & objEventobject.TargetInstance.type & vbcrlf _
& " Event ID: " & objEventobject.TargetInstance.eventcode &vbcrlf _
& " Event source: " & objEventobject.TargetInstance.sourcename & vbcrlf _
& " Event Log: " & objEventobject.TargetInstance.logfile & vbcrlf _
& " Event Time: " & objEventobject.TargetInstance.timewritten & vbcrlf _
& "The Event Err details are :- " & vbcrlf _
& objEventobject.TargetInstance.Message

'==This section provides the configuration information for the remote SMTP server.
'==Normally you will only change the server name or IP.
objemail.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2

'Name or IP of Remote SMTP Server
objemail.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "mail.mydomain.com"

'Server port (typically 25)
objemail.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25

objemail.Configuration.Fields.Update

'==End remote SMTP server configuration section==



objEmail.Send

Wend





James Chong
MCSE M+, S+, MCTS, Security+
msexchangetips.blogspot.com


How useful was this article? Want to see a tip not listed? Please leave a comment.

3 Comments:

Anonymous brijraj said...

Hi James,
It was indeed a vital post for me, i am looking forward to monitor all the incoming msgs at an exchange server 2003, and do something with the msgs for which recepients are not available.

any quick views? i'll appreciate.

thanks and regards

brij

12:19 AM  
Anonymous Alex said...

On as regards backup i know little,but restore-convert a microsoft exchange .ost to .pst,may program for Exchange recovery ost was made to recover Exchange with ost files Outlook 2003,allows to recover all files separately: *.eml, *.vcf and *.txt files will be extracted and placed in the same folder,program is based on effective *.ost files recovery technology, that allows easily convert them to *.pst files, that can be opened by any mail client, compatible with Microsoft Outlook.

4:49 AM  
Anonymous Anonymous said...

For many people, the first type of Men’ Footwear that we believe that during the consideration of Hogan scarpe for men in May of tennis shoes or even a generic cross-training shoes. For others, they believe in May of Hogan scarpe donna , it depends on your background. In fact, this category of hogan donna covers a wide range of sports shoes and leisure activities ranging from golf and basketball and soccer shoes race. I tend to buy Hogan scarpe uomo against training only because I am involved in a wide range of sports and weightlifting, the race to play basketball.

5:21 PM  

Post a Comment

<< Home

xml:lang="en" lang="en"> MS Exchange Tips: Exchange: Event Monitoring Via WMI (Backup Report)