Server 2008 email on Event variables

Question

One of the new features of Server 2008 is the ability to attach a task to a specific event in the event logs. One of the actions available is to send an email through a SMTP server.

This is working great, however it would be ideal if in the message body, the Event contents could be placed. I have tried using $eventdescription and %eventdescription%, but those are just shots in the dark. Any amount of googling produces no results.

Does anyone know if this is possible?

Update: Sparks' suggestion below is a step in the right direction I believe, however that method doesn't seem to work for all values. For example, I can pull the RecordID, Severity and Channel as shown, but I can't use the same method to retreive the EventID, or most importantly the description.

Here's the raw XML from one event:

[Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"]
  [System]
    [Provider Name="DFSR" /] 
    [EventID Qualifiers="16384"]4412[/EventID] 
    [Level]4[/Level] 
    [Task]0[/Task] 
    [Keywords]0x80000000000000[/Keywords] 
    [TimeCreated SystemTime="2009-05-14T18:18:09.000Z" /] 
    [EventRecordID]45692[/EventRecordID] 
    [Channel]DFS Replication[/Channel] 
    [Computer]servername.domain.com[/Computer] 
    [Security /] 
    [/System]
  [EventData]
    [Data]9046C3F4-843E-4A53-B941-4B20764072E5[/Data] 
    [Data]D:\departments\Geomatics\Plan Quality\Data Processing\CG3533017 2009-05-13 KT FIXED[/Data] 
    [Data]D:\departments[/Data] 
    [Data]{26D5F604-E603-4F87-8EC3-DE9A945DA8FD}-v927199[/Data] 
    [Data]Departments[/Data] 
    [Data]domain.ca\files\departments[/Data] 
    [Data]B8242CE2-F5EB-47DA-BA5B-1DD2F7EE3AB9[/Data] 
    [Data]DFAA7A54-66CB-4C31-81A0-0F861382C32C[/Data] 
    [Data]CG3533017 2009-05-13-{26D5F604-E603-4F87-8EC3-DE9A945DA8FD}-v927199[/Data] 
  [/EventData]
 [/Event]

I have tried using a ValueQuery for EventData, but it returns no data.

Answer 1

I don't have access to a Server 2008 or Vista machine to try this myself and get the variable for you but this article should be of use.

If you create a basic task and then view the XML of the task you should see all the values available.

http://blogs.technet.com/otto/archive/2007/11/09/find-the-event-that-triggered-your-task.aspx

Answer 2

Using the documentation in the link provided by Sparks, add this additional line to the XML exported from Task Scheduler to get your event text:

<Value name="eventData">Event/EventData/Data</Value>

Also interesting (and hopefully self-explanatory):

<Value name="eventTimeCreated">Event/System/TimeCreated/@SystemTime</Value>

I found this Googling "Event/System/EventRecordID"

You can then reference the $(eventData) and $(eventTimeCreated) variables in your task.

It looks as though the values are specified by stepping through the XML hierarchy. I would expect you to be able to specify most any parts of the event by decomposing the raw XML dump to create a slash delimited expression.

It looks as though '/@' is shorthand for a space character in this syntax.

Answer 3

Are you after the event data?

My requirement was to send an email whenever an IIS Application Pool shut down due to idle time out. I wanted the name of the app pool that was being shut down to appear in the email message.

This worked for me:

<Value name="appPoolId">Event/EventData/Data[@Name='AppPoolID']</Value>