Script to pull warning/errors event logs from multiple servers and email

Not what you asked for, but maybe someone would be interested, here's one I wrote that looks for specific event ID's within a certain time frame, formats it into a HTML file. You can do whatever method you prefer to then e-mail that file. Change the variable $5hoursH to a value you want, and down in the process section change the target event log and filter the appropriate event ID's.

I use reuse this code for several scripts that do things like scan Exchange mailboxes for corruption or verify mass automated application installs were successful. I just enter in the additional code in the begin or process section as needed so it's all performed by a single script. For example, I might pull from a SQL DB server names and feed them into a variable, build a function that runs an install from some network location, then I would change the relevant code I've included here to scan all of the servers for particular event ID's (success or failure) from the previous hour.

param( [parameter(Mandatory=$true)][string]$server, [parameter(Mandatory=$true)][string]$reportfile )

begin {

$rightNow = get-date $5hoursH = $rightNow.AddHours(5)

$HTMLhead = @" <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head> <title>Event Log Report</title> <style type="text/css"> BODY {font: 10px geneva, verdana, arial, sans-serif;color: #3D3D3D;background-color: #ffffff;} H3 {font: geneva, font-weight: bold} TABLE{border-width: 1px;border-size: 1px;border-color:#c0c0c0;border-style:dotted none double solid} TH{background-color:#c0c0c0;padding:3px} TD{background-color:#f0f0f0;padding:3px;border-width: 1px;border-size: 1px;border-color:#c0c0c0;border-style:none dotted none none} </style> </head> <body> <h3>Event Log Report for $server from <i>$rightNow</i> to <i>$5hoursH</i></h3><br> "@

}

process {

function get-evts { get-eventlog -ComputerName $server -logname application -after $rightNow }

$events = get-evts

$eventsHTML = $events | select-Object @{Expression={$.TimeWritten};Label="Time"},EventID,Message | where-object -FilterScript {$.eventId -eq "10049" -or $_.eventID -eq "10062"} | sort-object "Time" | ConvertTo-Html -fragment

$ItemHTML = @"

$eventsHTML

"@

$HTMLreport += $ItemHTML

}

end {

$HTMLhead +$ItemHTML | out-file $ReportFile }

/r/PowerShell Thread