Home / server / Questions / 316778
Accepted
marko
Asked: 2011-09-30 03:15:04 +0800 CST

How to get eventlog information in a scheduled task email?

  • 772

I have a scheduled task that sends a email when something happens on a application. Now I want to send the message details of the event also in the email. How to do that?

In Windows Server 2008 R2 with the Task Scheduler.

task-scheduler windows-server-2008-r2

2 Answers

  1. Best Answer

    The only way to accomplish this is a bit of a workaround (in my opinion). You will need to create two actions for your task. The steps are as follows:

    1. Event is triggered
    2. The first action runs a query for the event details you're interested in and saves them to a file.
    3. The second action attaches the event details saved in Step 2 to an e-mail and sends it off.

    The process is detailed here: http://blogs.technet.com/b/jhoward/archive/2010/06/16/getting-event-log-contents-by-email-on-an-event-log-trigger.aspx

    • 5

  2. That is not the only way to accomplish it. There's actually a much better way that works in windows server 2008 at the very least:

    https://web.archive.org/web/20121106034308/http://www.buit.org/2009/07/16/event-based-triggered-tasks/

    To summarize, you need to export the task definition to xml, add some xpath queries for the data you want in a text editor, update your commandline, and then import your updated task definition back into task scheduler.

    Once exported open xml file and find the <EventTrigger> node.

    Create child node <ValueQueries>

    <ValueQueries>
    <Value name="EventID">Event/System/EventRecordID</Value>
    <Value name="Channel">Event/System/Channel</Value>
</ValueQueries>

    You can then reference this value query data in your commandline with $(EventID) and $(Channel). From my testing email events do not substitute these values correctly. Instead you need to execute a commandline. Of course you can add xpath queries to any data in the event, and these are just examples.

    You may also experience some challenges in passing certain data from these data queries to a commandline (various characters including quote, slashes, etc... may conflict with the special characters in your command interpreter). To mitigate this i have taken to using the two parameters defined above, and then retrieving the remaining event data using wevtutil:

    wevtutil qe "$(Channel)" /q:"*[System[(EventREcordID=$(EventID)]]" /f:xml

    you can then do what you want with the full xml text of the event record that generated the alert (such as send an email, parse the xml, etc...)

    for example you may define the following action in your task to write the event xml to disk:

    <Exec>
    <Command>powershell.exe</Command>
    <Arguments>start-transcript -path C:\alertlog.log -append; add-content -path C:\output.txt -value (wevtutil qe "$(Channel)" /q:"*[System[(EventRecordID=$(EventID))]]" /f:xml); stop-transcript;</Arguments>
</Exec>

    The referenced blog post goes into greater detail.

    • 5