Kaseya Community

Retrieve specific Event Log ID?

This question is not answered

I'm to retrieve the specific Event Log ID of 1001, with the Source: Wininit and Log Name: Application. Even better is if I could get the log into a plain text file, and have it e-mailed to me.


I know there is command to retrieve the whole Application log into an evt:

wmic nteventlog where "Logfilename = 'Application'" Call BackupEventLog "#kworking#\applog.evt"

But how do I request that only a specific EventID and Source name appears in the .evt?



All Replies
  • Create an Event Set with the event ID you're interested in. Then run a report from Info Center > Log > Event Log and list matching machine ID's.

  • I'm more looking for something that I can search for a "success" or "fail" string within the event log (like an evt or text file), so I can automate knowing whether the chkdsk succesfully completed or skipped.

    The only way I know how to retrieve that exact event log is with powershell, but I don't want to have to go through installing it on every XP machine.

  • Create an event set like SMason suggested, and assign it to the agents you want to monitor.

    When assigning, be sure to tick the 'Send Email' checkbox and enter your email address. This way you'll receive an email when the event entry gets written to the event log, containing the details (description etc) of the event entry.


    Edit: Also, you can filter on the text in the description when you define the event set. This way you can configure the event set to only trigger when chkdsk fails, rather than spamming your mailbox every time it runs.

    [edited by: Stefan at 1:32 AM (GMT -8) on 12-23-2011] Added a suggestion