Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a scheduled task setup in Windows 2008 R2 to send me an email if a specific event is logged to the event log. This works great. However, I'd like to include the event description from the event in the email. I don't see a way to do this. Anyone have any ideas (within scheduled tasks / event manager -- I'm sure I could buy / get a 3rd party app to do it)

share|improve this question
possible duplicate of Server 2008 email on Event variables – mgorven Jun 26 '12 at 0:28
up vote 0 down vote accepted

Have a look at this thread:

cheers, Stefan

share|improve this answer

One approach:

When creating the scheduled task that fires for the event, have two actions. The first action, a 'Start Program' action, queries the specified event log for the last event for that criteria (such as event ID), and save the event information to file. The second action would be the email, which includes the file as an attachment.

When creating the Start Program action, it calls GetLastEvent.cmd with three paramters: the event log name, the event id (if that is what is used for the criteria), and the name of the output file that has the exported event description.

E.g. the command would be: 'C:\Util\GetLastEvent.cmd ForwardedEvents 467 %temp%\Last467Event.txt'

enter image description here

When creating the email action, specify the name of the attachment file that includes the event information:

enter image description here


SET EventLog=%1%
SET EventId=%2%
SET OutputFile=%3%

del %OutputFile%
wevtutil qe %EventLog% "/q:*[System [(EventID=%EventId%)]]" /f:text /rd:true /c:1 > %OutputFile%


More information:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.