Powershell script that will alert me when a certain windows event occurs
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(278.4, 21%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
RayPaks
31
Reputation points
Hi. I've been trying to get this working but I've seemed to have hit a brick wall.
Trying to figure out a way to establish an email alert that will let me know when a certain Windows EventID happens.
Preferably I want this set up in SQL server as a job because you can access the powershell subsystem in the job steps, and set a job schedule therein but I'm open to having it set up any other way
I've seen a couple of posts on some forums that were helpful but not helpful enough for me to get this over the line.
A number of them use powershell and then Task scheduler to run a task, this link was helpful and I followed the steps but it is still not working:
Please let me know
Windows for business | Windows Server | User experience | PowerShell
SQL Server | Other
{count} votes
-
Bjoern Peters 8,921 Reputation points2022-10-05T11:17:27.443+00:00 What is your problem?
At which step do "you" fail?Do you already have a functional PowerShell script, or do you still developing it?
Are you trying to implement it as SQL Server agent job or as a scheduled task?
What is the error message, or at which action does it stop working?
-
RayPaks 31 Reputation points
2022-10-05T22:02:50.267+00:00 @Bjoern Peters I have this script I got from that link in my original post. And I want to implement it as SQL server agent job. I've set up the job with only 1 step in it. To run that powershell script which is given below. further below is the error.
-- ps script
$EventId = 210,1135,1146,1177,1564,1563
$A = Get-WinEvent -MaxEvents 1 -FilterHashTable @{Logname = "System" ; ID = $EventId}
$Message = $A.Message
$EventID = $A.Id
$MachineName = $A.MachineName
$Source = $A.ProviderName
$EmailFrom = "XXXReports@X .com.XX"
$EmailTo = "RPaks@X .com.XX"
$Subject ="Alert From $MachineName"
$Body = "EventID: $EventIDnSource: $SourcenMachineName: $MachineName `nMessage: $Message"
$SMTPServer = "owa.XXX.com.XX"-- error
Date 06/10/2022 7:50:00 am
Log Job History (Cluster-Alert)Step ID 1
Server SQLXXX0202
Job Name Send email
Step Name Check status and send email
Duration 00:00:01
Sql Severity 0
Sql Message ID 0
Operator Emailed
Operator Net sent
Operator Paged
Retries Attempted 0Message
Executed as user: XXXXX\SQLXXX0202. The job script encountered the following errors. These errors did not stop the script: A job step received an error at line 2 in a PowerShell script. The corresponding line is '$A = Get-WinEvent -MaxEvents 1 -FilterHashTable @{Logname = "System" ; ID = $EventId} '. Correct the script and reschedule the job. The error information returned by PowerShell is: 'No events were found that match the specified selection criteria. '. Process Exit Code 0. The step succeeded. -
MotoX80 37,161 Reputation points2022-10-06T00:02:45.927+00:00 Verify that your user account can access the event log.
Get-WinEvent -MaxEvents 10 -FilterHashTable @{Logname = "System" }Take the event id's that you can read and then add them to $eventid and add that filter. Test again. Maybe there aren't any events with those ID's.
Can SQL trigger a job when event is generated? If not, you will need to use the Windows task scheduler if your primary requirement is "alert that will let me know when a certain Windows EventID happens".
-
RayPaks 31 Reputation points
2022-10-06T00:37:59.307+00:00 Yes the account has domain admin access, more than enough.
The EventIDs are actually failover cluster events, so I'm stopping the cluster server and or taking the File share witness offline for these events to start getting logged however even after doing that and running the job, there is still no email and it just gives that error.
OK so I'll have to use Task Scheduler then. I set it up using the 'On an event' trigger and still nothing. Plus I'm not sure how to configure a schedule for the task to run for that kind of trigger. I want it to run at 5 minutes intervals but the option doesn't seem to be there
-
MotoX80 37,161 Reputation points
2022-10-06T00:56:17.71+00:00 You don't run it at any interval, run it when the event is generated.
Attach a task to the event.
https://www.bing.com/search?q=windows+attach+a+task+to+this+event
-
RayPaks 31 Reputation points
2022-10-06T01:39:34.667+00:00 OK I did come across this but those options are already deprecated. Why on earth did they think it was a good idea to get rid of this functionality? So that's why now the deprecated part of it needs to be done manually through some other means (I think powershell is best) to get the email sent at the time the appropriate Event ID gets logged
-
MotoX80 37,161 Reputation points
2022-10-06T12:37:52.89+00:00 Probably because they could not build an email interface that would accommodate all of the ways that users might want to send emails. Ie, HTML formatted body, attachments, CC, BCC, and different SMTP server authentication methods. By launching a program, then the user can do whatever he wants and in whatever way his environment requires.
Sign in to comment
Sign in to answer