Monitor Failovercluster and SMBServer events

Priya 211 Reputation points
2021-08-06T18:31:04.087+00:00

Hello All,

Good Morning.

I am looking for a method to monitor the event log for a particular event ID and description, if it matches, want to take action based on each eventID i am interested to watch for.

When i tried to monitor the Security log, the following script worked fine.
However if i use the same logic to monitor Microsoft-Windows-FailoverClustering/Diagnostic it doe not work. Though the eventID i am interested in does get created in the eventlog, still the script couldn't monitor that event and action is not called at all.

working script

Event log watch -- New User Creation on local system

$WMI = @{
Query = "select * from __InstanceCreationEvent where TargetInstance isa 'Win32_NtLogEvent' and TargetInstance.logfile = 'Security' and (TargetInstance.EventCode = '4720')"
Action = {
$AccountCreated = $event.SourceEventArgs.NewEvent.TargetInstance.insertionstrings[0]
$CreatedBy = ("{0}{1}" -f $event.SourceEventArgs.NewEvent.TargetInstance.insertionstrings[5],$event.SourceEventArgs.NewEvent.TargetInstance.insertionstrings[4])
Write-Host -Foreground Green -Back Black ('New Account: {0} was created by: {1}' -f $ACcountCreated,$CreatedBy)
$Global:data = $Event
}
SourceIdentifier = "Account.Created"
}
$Null = Register-WMIEvent @WMI

Not working

$WMI1 = @{
Query = "select * from __InstanceCreationEvent where TargetInstance isa 'Win32_NtLogEvent' and TargetInstance.logfile = 'Microsoft-Windows-FailoverClustering/Diagnostic' and (TargetInstance.EventCode = '2051')"
Action = {
Write-Host -Foreground Green -Back Black ('works ')
}
SourceIdentifier = "FailoverClustering"
}
$Null = Register-WMIEvent @WMI1

Register-CimIndicationEvent -Query $cq -SourceIdentifier cq

Any suggestions would really help.

Thanks in advance for the help.

Windows Server Clustering
Windows Server Clustering
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Clustering: The grouping of multiple servers in a way that allows them to appear to be a single unit to client computers on a network. Clustering is a means of increasing network capacity, providing live backup in case one of the servers fails, and improving data security.
963 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Priya 211 Reputation points
    2021-08-16T17:20:49.6+00:00

    Thank you so much for the pointers. Will explore it. Thanks again.

    0 comments No comments