Event Log Email Details On Event

[ITGURU]

So i have some 2016 servers where when a particular event ID is generated I want to receive an email with the full details of the event.

I have created a powershell script assigned to the ID so I get a notification email, but only with the content I enter in the script. I'd then have to check the event log for the details.

I'd like to have the email either contain or attach the full details of the event ID.

Any scripting people out there able to help?

Thanks.

[derf]

You can run a scheduled task on an event trigger, and then you can pass the event parameters to an external script.

 

Here's an example that I use for handling delete events for auditing all file deletions:

 

Note the ValueQueries and the parameters passed to the vb script.

 
   2017-06-04T09:52:14.5408888
   IT Department
   \Event Viewer Tasks\Delete File
 
 
   
     true
     *[system[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4656]] and *[EventData[Data[@Name="ObjectType"]="File"]]
     

 Event/EventData/Data[@Name='SubjectUserName']
 Event/EventData/Data[@Name='ObjectName']
 Event/EventData/Data[@Name='AccessList']
 Event/System/TimeCreated/@SystemTime

     
   
 
 
   
     S-1-5-21-2324878270-345525128-4222137208-1000
     InteractiveToken
     LeastPrivilege
   
 
 
   IgnoreNew
   true
   true
   true
   false
   false
   
     true
     false
   
   true
   true
   false
   false
   false
   PT72H
   7
 
 
   
     C:\Windows\System32\cscript.exe
     C:\Scripts\MyScript.vbs "$(AccountName)" "$(ObjectName)" "$(Logged)" "$(Access)"
   
 

[HPlum78]

$SMTPServer = 'YourSMTPServer.YourDomain.com'
$mailFromAddress = '[email protected]'
$mailtoAddress = '[email protected]'

$evtData = Get-EventLog -LogName System -Newest 1 | select *


   $mailBody = $evtData.Message 
   $mailFrom = $mailFromAddress
   $mailTo =  $mailtoAddress
   $mailSubject = "Event $($evtData.EventID) has been raised on $($evtData.MachineName)"
   $SMTPServer = $SMTPServer


   Send-MailMessage -From $mailFrom -To $mailTo -Subject $mailSubject -body $mailBody -SmtpServer $SMTPServer

 

 

Something like the above in code I think....

 

In fact the $mailBody line I would do like this now I have actually run the code! $mailBody = "Event Type:- `r $($evtData.EntryType)`r `nEvent Message: `r $($evtData.Message) `r `nEvent Generated `r$($evtData.TimeGenerated)"

Edited June 20, 2018 by HPlum78