For dummies steps to setup ntevt to alert on failed tasks in task scheduler?

Question

I want to do this on a stand alone Windows 10 PC.

I have this instruction on the fact that setting up ntevt to alert on failed tasks in task scheduler https://knowledge.broadcom.com/external/article/37223/how-do-i-monitor-windows-scheduled-tasks.html.

However, it really doesn't show a step-by-step click-through i.e, DO THIS>THEN DO THAT>ETC., so that someone with my modest capabilities can set it up and receive the alerts.

Can you point me to more complete if not simpler instructions?

Answer 1

Windows does not have an ntevt.exe. It has a dll (C:\Windows\System32\wbem\ntevt.dll) but you can't run that directly.

The web site you referenced mentions NTEVL which appears to be part of "CA Unified Infrastructure Management SaaS (Nimsoft / UIM)".

https://knowledge.broadcom.com/external/article/136696/ntevl-probe-alarms-are-not-clearing.html
https://knowledge.broadcom.com/external/article/123213/ntevl-probe-will-not-start-or-crashes-as.html

If you have that software installed you will need to consult it's product documentation as to how to configure alerts.

Based on your question, I doubt that you are using that software. You will need to explain what your specific monitoring requirements are and the task failures that you have encountered.

One option would be use a Powershell script that watches tasks' LastTaskResult and generates an audible alert when it sees a non zero return code.

Save this as TaskMonitor.ps1 file, open a "Run as administrator" Powershell prompt, and run it.

Script was updated 7/10/2022.

#----------------------------------------------  
# Script: TaskMonitor.ps1  
# Author: Motox80 on Microsoft Technet Forums  
#----------------------------------------------  
# The LookInterval should be greater than 2 minutes due to a bug in Get-ScheduledTaskInfo  
# The seconds value always matches the minutes value in LastRunTime.   
$LookInterval = 121      # in seconds, how often should we look for a failure   
Add-Type -AssemblyName System.speech  
$SpeechSynthesizer = New-Object –TypeName System.Speech.Synthesis.SpeechSynthesizer  
$SpeechSynthesizer.SelectVoice("Microsoft Zira Desktop")  
$RunningTasks = @()  
cls  
"{0} - Monitoring started." -f (Get-Date)  
  
Function Report ($t) {  
    if ($t.LastTaskResult -eq 0) {                  # Success   
        "{0} - {1} - {2} - {3}" -f   $t.LastRunTime, $t.TaskName, $t.LastTaskResult, $t.TaskPath   
    } elseif ($t.LastTaskResult -eq 2147946720) {   # The operator or administrator has refused the request.    
        "{0} - {1} - {2} - {3}" -f   $t.LastRunTime, $t.TaskName, $t.LastTaskResult, $t.TaskPath | Write-Host -ForegroundColor Yellow   
    } else {  
        "{0} - {1} - {2} - {3}" -f   $t.LastRunTime, $t.TaskName, $t.LastTaskResult, $t.TaskPath | Write-Host -ForegroundColor Cyan   
        $SpeechSynthesizer.Speak("Warning $($t.TaskName) has failed")  
    }  
}  
  
while ($true) {  
    # This section will monitor tasks that started and ended within the LookInterval timeframe  
    $AllTasks = Get-ScheduledTask -TaskPath \     # Snapshot of current tasks since some were getting missed   
    $AllTasks | Where-Object -Property State -ne Running | Get-ScheduledTaskInfo | foreach {   
         #"     {0} - {1} - {2}" -f   $_.LastRunTime, $_.TaskName, (New-TimeSpan -start $_.LastRunTime -end (get-date)).TotalSeconds  
        if ((New-TimeSpan -start $_.LastRunTime -end (get-date)).TotalSeconds -lt $LookInterval) {  
            Report $_  
        }  
     }  
     # Now analyze the tasks that were still running during our last analysis.   
     $RunningTasks | foreach {  
        Get-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath  | Where-Object -Property State -ne Running | Get-ScheduledTaskInfo | foreach {  
            Report $_  
        }   
     }  
     $RunningTasks = @()        # reset the array   
     $AllTasks | Where-Object -Property State -eq Running | foreach {  
        $RunningTasks +=  [PSCustomObject]@{  
            TaskName = $_.TaskName;  
            TaskPath = $_.TaskPath   
            }  
     }  
     Remove-Variable AllTasks  
     Start-Sleep -Seconds $LookInterval  
}  



  

Answer 2

Thank you so much, MotoX80. That's exactly what I mean. I'd settle for what ever updates you can share on your work in progress on it. Anything that tells me what scheduled tasks in task scheduler failed in the last 24 hours works. I don't have to get an alert in real time.

Answer 3

Well, I have good news and I have bad news. Your question got me curious about the tasks that were running on my own Win11 laptop. So I wrote that first script. But it appeared that it was missing some tasks. The results were not including every task that I ran. After some troubleshooting, I have discovered that there is a bug in Powershell's Get-ScheduledTaskInfo cmdlet. In the LastRunTime value, the seconds always matches the minutes value.

So for tasks that ran in the last 24 hours, you could run this.

Get-ScheduledTask | Where-Object -Property State -ne Running | Get-ScheduledTaskInfo | Where-Object -Property LastTaskResult -ne 0 | foreach {   
        if ((New-TimeSpan -start $_.LastRunTime -end (get-date)).TotalHours -le 24) {  
             $_  
        }  
    } | Sort-Object -property LastRunTime | Format-Table -Property TaskName, LastRunTime, LastTaskResult  

The main problem with this code is that if you have a task that runs every hour, it will only report on the last execution. Maybe that's ok for you.

I have updated my script in my first reply. It seems that if I only look for results every 2 minutes or so, that compensates for the incorrect seconds value.

These scripts need to execute with "run as administrator" access so that it can see every task. Give these a try.

Answer 4

What kind of file do I put the command strings into? How do I run it?

Answer 5

Hi there,

As far as I know, it is not possible to create dynamic notifications from TaskScheduler.When a scheduled task fails to start, an event is written to the TaskScheduler event log. Windows lets you trigger scheduled tasks to start when a variety of events happen, e.g.:
-Time of day
-System startup
-User login
-Event recorded in the event log

Armed with this knowledge, you can create a scheduled task that runs when your scheduled task fails.

1. Create a PowerShell script that would try to execute your batch
2. Check that script is executed correctly if not send an email via PowerShell.

Task Scheduler - Failed Task Notifications

https://social.technet.microsoft.com/Forums/en-US/dfb177ba-9a6d-4e91-9122-c4cefbd2dd8c/task-scheduler-failed-task-notifications?forum=windowsserver2008r2general

----------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer–