3

I want to use powershell to alert me when an error occurs in the event viewer on my new Win2k12 Standard Server, I was thinking I could have the script execute every 10mins but don't want to put any strain on the server just for event log checking, here is the powershell script I want to use:

$SystemErrors = Get-EventLog System | Where-Object { $_.EntryType -eq "Error" }
If ($SystemErrors.Length -gt 0) {
  Send-MailMessage -To "zeb@company.co.nz" -From $env:COMPUTERNAME + @company.co.nz" -Subject $env:COMPUTERNAME + " System Errors" -SmtpServer "smtp.company.co.nz" -Priority High
}

What is a safe frequency I can run this script at without hurting my server?

Hardware:

Intel Xeon E5410 @ 2.33GHz x2
32GB RAM
3x 7200RPM S-ATA 1TB (2x RAID1)

Edit:

With the help of Mathias R. Jessen's answer, I ended up attaching an event to the application & system log with the following script:

Param(
    [string]$LogName
)

$ComputerName = $env:COMPUTERNAME;

$To = "zeb@company.co.nz"
$From = $ComputerName + "@company.co.nz";
$Subject = $ComputerName + " " + $LogName + " Error";
$SmtpServer = "smtp.company.co.nz";

$AppErrorEvent = Get-EventLog $LogName -Newest 1 | Where-Object { $_.EntryType -eq "Error" };

If ($AppErrorEvent.Length -eq 1) { 
    $AppErrorEventString = $AppErrorEvent | Format-List | Out-String;

    Send-MailMessage -To $To -From $From -Subject $Subject -Body $AppErrorEventString -SmtpServer $SmtpServer -Priority High;
};
Zeb Rawnsley
  • 145
  • 1
  • 2
  • 8

1 Answers1

3

No need to script your way out of that.

You can attach tasks to specific events in the Event Viewer, it works the same way in 2012 as in 2008: Right-click an instance of the specific event in the Viewer, and select "Attach a Task To This Event".

You can also attach a task to an entire event log.

The following article goes through setting up emailing task, specifically: http://blogs.technet.com/b/jhoward/archive/2010/06/16/getting-event-log-contents-by-email-on-an-event-log-trigger.aspx

Mathias R. Jessen
  • 25,161
  • 4
  • 63
  • 95
  • Thanks, I've already seen that article, that method forces me to define every error I want to be notified about, however I want any event where the EntryType is "Error" without having to know the EventID/Application/Specifics of the error. – Zeb Rawnsley Dec 16 '12 at 00:32
  • Attach a task to the entire Event Log, instead of a specific event, with the "Attach a Task to this Log" link in the Action pane in eventvwr. Have the task execute a powershell script that reads the latest eventlog entry and checks if it is an error – Mathias R. Jessen Dec 16 '12 at 00:34