Reading Event Logs in Win2008
2

Question

Reading Event Logs in Win2008

PinkeyNBrain (IS/IT--Management)

(OP)

29 Aug 14 14:45

I've been successfully using a home-grown event viewer that used

CODE

$handle=Win32::EventLog->new($event_group, $server_name) ;

where $event_group was one of the basic "Application", "System", or "Security".

One of the routines looked for print jobs to help me keep track of the heaviest users. Either they got first dibs on printer maintenance or see if I could find a way to curtail their printing .. anyway, I now have a Win2008 server - of which MS kindly decided to move the location of where print events are saved. I can find them under the event viewer gui, but not sure how to translate that into it's like name thru Win32::EventLog

I've found some info on EventForwarding which I'd rather avoid if I could. From one perspective, this will only add a level of complexity to something I have that already works (mostly works).

PinkeyNBrain (IS/IT--Management) · Answer 1 · 2014-09-05 09:15:55

Well - never found out how to do this the way I wanted (which essentially involved changing the least amount of code possible). My original method used the 'EventLog' routine as presented above. This was nice as I was able to process data inline. What I came up with is less efficient but it works and in the end that's all I really need. The high level idea here is to run several power-shell commands to generate my own log files, then to read the log files and process them. Effectively the $handle variable as defined above is being replaced with a file handle pointing to a *.txt file. Here is the code I used. The first connects to a Win2008 server (which started all this) the second connects to a Win2003 server (of which I still have several)

The 'get-winevent' and 'get-eventlog' are the two main commands of note here

CODE --> powershell

$date = (get-date).AddDays(-30)
$outdir  = "I:\usr\local\tool_kit\Data_Dumps"
$server  = "TRE-AS-03"
$logname = "Microsoft-Windows-PrintService/Operational"
$logref  = "PrintService"
$outfile = "${server}_${logref}.txt"
$outpath = "$outdir\$outfile"
get-winevent -computername $server -FilterHashTable @{ logname = $logname; StartTime = $date} | format-list >$outpath

$server  = "TRE-AS-01"
$logname = "System"
$logref  = $logname
$outfile = "${server}_${logref}.txt"
$outpath = "$outdir\$outfile"
get-eventlog -Log $logname -computername $server -After $date | format-list >$outpath

Come Join Us!

Posting Guidelines

Reading Event Logs in Win2008
2