a sample script to monitor event IDs and email the event to the specified email address. This sample code implements the use of WMI quering the Win32_NTLogEvent class for event ID 213. Event ID Source ESE 213 indicates the completion of Exchange Backups. If you do not see Event ID 213, you may be using a third party backup application that does not use the Exchange backup API. If this is the case, you will need to identify the event ID that your third party application uses.
The script will email out so you will need to specify your SMTP server in this script.
Note: You can use built in Windows command eventcreate.exe to simulate event to test.
Event ID 213
Information Store (4168) TEST.NET: The backup procedure has been successfully completed.
1. Modify the portion of the script to specify the source and destination email addresses to send from and to.
2. Copy the contents below and name the file eventmon.vbs
3. Double Click the file. It will continously monitor for the event 213. Therefore you will see wscript process running in task manager process tab. To terminate the job, click end task.
set objEmail = CreateObject("CDO.Message")
'strComputer=Inputbox("Enter the computer name you want to monitor")
'if strcomputer="" then
strComputer = "."
'end if
set objwmiservice=getobject("winmgmts://" &strcomputer &"/root/cimv2")
strwql="select * " & _
"from __instancecreationevent " & _
"where targetinstance isa 'Win32_NTLogEvent' " & _
"and targetinstance.eventcode = '213' "
set objeventsource=objwmiservice.execnotificationquery(strwql)
wscript.echo "waiting for an event to happen on " &strcomputer
While True
set objeventobject=objeventsource.nextevent()
objEmail.Subject = objEventobject.TargetInstance.ComputerName & _
objEventobject.TargetInstance.logfile & "\" & _
objEventobject.TargetInstance.sourcename
objEmail.From = "admin@mydomain.com"
objEmail.To = "admins@mydomain.com"
objEmail.Textbody = "Computer Name: " & _
objEventobject.TargetInstance.ComputerName & _
"Notification E-Mail from Automated windows event monitoring script." & vbcrlf _
& " Event Type: " & objEventobject.TargetInstance.type & vbcrlf _
& " Event ID: " & objEventobject.TargetInstance.eventcode &vbcrlf _
& " Event source: " & objEventobject.TargetInstance.sourcename & vbcrlf _
& " Event Log: " & objEventobject.TargetInstance.logfile & vbcrlf _
& " Event Time: " & objEventobject.TargetInstance.timewritten & vbcrlf _
& "The Event Err details are :- " & vbcrlf _
& objEventobject.TargetInstance.Message
'==This section provides the configuration information for the remote SMTP server.
'==Normally you will only change the server name or IP.
objemail.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
'Name or IP of Remote SMTP Server
objemail.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "mail.mydomain.com"
'Server port (typically 25)
objemail.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
objemail.Configuration.Fields.Update
OR go here:
http://www.mydigitallife.info/2008/06/28/script-to-backup-current-start-state-startup-type-of-windows-services/
Please post back if you have any more problems or questions.
If this info is useful, please mark it helpful. Thanks
