Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a scheduled task setup in Windows 2008 R2 to send me an email if a specific event is logged to the event log. This works great. However, I'd like to include the event description from the event in the email. I don't see a way to do this. Anyone have any ideas (within scheduled tasks / event manager -- I'm sure I could buy / get a 3rd party app to do it)

share|improve this question
    
possible duplicate of Server 2008 email on Event variables –  mgorven Jun 26 '12 at 0:28

2 Answers 2

up vote 0 down vote accepted

Have a look at this thread: http://serverfault.com/questions/5474/server-2008-email-on-event-variables

cheers, Stefan

share|improve this answer

One approach:

When creating the scheduled task that fires for the event, have two actions. The first action, a 'Start Program' action, queries the specified event log for the last event for that criteria (such as event ID), and save the event information to file. The second action would be the email, which includes the file as an attachment.

When creating the Start Program action, it calls GetLastEvent.cmd with three paramters: the event log name, the event id (if that is what is used for the criteria), and the name of the output file that has the exported event description.

E.g. the command would be: 'C:\Util\GetLastEvent.cmd ForwardedEvents 467 %temp%\Last467Event.txt'

enter image description here

When creating the email action, specify the name of the attachment file that includes the event information:

enter image description here

GetLastEvent.cmd

SETLOCAL
SET EventLog=%1%
SET EventId=%2%
SET OutputFile=%3%

del %OutputFile%
wevtutil qe %EventLog% "/q:*[System [(EventID=%EventId%)]]" /f:text /rd:true /c:1 > %OutputFile%

ENDLOCAL

More information:

https://blogs.technet.com/b/jhoward/archive/2010/06/16/getting-event-log-contents-by-email-on-an-event-log-trigger.aspx

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.