Get EventID and Message from client machine via SCCM

Question

Hi All

I have a requirement to fetch couple of event ID along with respective message. Is there any way to achieve this via SCCM.

Dont want to enable WMI class, as it will increase the load on DB and Network.

Please advice.

Answer 1

"in general", gathering individual eventIDs and messages isn't a function of ConfigMgr / MECM / MEMCM (formerly known as SCCM). That is more of a role of a utility like a monitoring agent.

fyi "enable the wmi class", unsure what you mean by that, if you mean the class called 'eventvwr' or something like that, that doesn't pull in actual events in eventvwr, it just pulls back things like "size of the event log overall", it's likely not what you want anyway...

That said, in my shady and and storied past, I have done (for others, who insisted their company needed it) helped others create a script, that would read "the last 5" events of EventiD 1234 (for example), and dump that info into a custom wmi class, and then inventory THAT.

I think it's horrible; and not a good fit for what MECM 'should' be doing / 'should' be used for.

...Ugh...I just looked at my old code. It was so long ago that I did that it was still in vbscript... from 2014. I certainly wouldn't want to share it. It's messy and outdated.

So... this is just my opinion I could be wrong... "even though" you could invent something to be a "Script + Inventory extension", where the script runs on a recurring schedule on the client, and inventory gets that info as copied to somewhere by the script... it isn't what CM is meant to do.

CM isn't meant for "monitoring eventids"; there are better products out there which are meant to monitor eventids. CM isn't it.