I want to track how many days since a particular WIndows event log entry has occurred for a load of agents. How would I go about this?
This can be done on a per agent basis, would that not work?
Yes but my question is how to do that specifically
You could assign a script to the particular Event set for the Event ID .. and have the script add an AgentProcedureLog entry .. which will be date stamped .. so you can now run a report against the ProcedureLog filtered for the particular log entry you added and will be able to see when each event last occured ..
creeate a script that uses some VBS to pull from the individual machines EventLogs a summary of event history for the specific eventID's
Thanks that makes sense