Recipe 8.1. Creating an EventProblemYou want to write an event to an event log. This can be useful if you want to document certain actions you've performed on a server. SolutionUsing a command-line interfaceThe following command is available on Windows Server 2003: > eventcreate /T <EventType> /ID <EventID> /L <LogName> /SO <EventSource> /D "<EventDescr>" The following command writes an event to the Application event log with event ID 999 and source SysAdmin: > eventcreate /T INFORMATION /ID 999 /L APPLICATION /SO SysAdmin /D "Restarting server after service pack install" The logevent tool, which is available in the Windows 2000 Resource Kit, can also be used to create events: > logevent -s <EventType> -e <EventID> -r <EventSource> "<EventDescr>" This example is equivalent to the eventcreate example where I created an event in the Application log: > logevent -s I -e 999 -r SysAdmin "Restarting server after service pack install" Using VBScript' This code creates an event in the Application event log. ' ------ SCRIPT CONFIGURATION ------ strServer = "\\<ServerName>" ' e.g., fs01 strDescr = "<EventDescr>" ' e.g., Restarting server after service pack install ' ------ END CONFIGURATION --------- Const EVENT_SUCCESS = 0 Const EVENT_ERROR = 1 Const EVENT_WARNING = 3 Const EVENT_INFO = 4 set objWSHShell = Wscript.CreateObject("Wscript.Shell") boolRC = objWSHShell.LogEvent(EVENT_INFO, strDescr, strServer) if boolRC = TRUE then WScript.Echo "Successfully created event." else WScript.Echo "Failed to create event." end if DiscussionMost Windows administrators use the event log as a passive tool, whereby they periodically scan the logs to see if there are any issues that need attention. You can, however, use the event logs in a more active capacity by documenting actions you perform on a server or configuration changes you make. With the command-line solutions I described, it is very easy to create a custom event message. You should consider creating an event every time you perform some significant action on a server, such as installing a new application. This uses the event logs as a poor man's change management system. Using a graphical user interfaceNone of the graphical tools (e.g., Event Viewer snap-in) allow you to create custom event log messages. Using a command-line interfaceTo create an event on a remote machine, specify the /S option followed by the host name for eventcreate, and specify -m followed by \\ and the hostname for logevent. Use /U and /P to specify an alternate user account and password, respectively, with eventcreate (there are no similar options for logevent). Using VBScriptWith WSH, you can create an event only in the Application log. The WMI Event Log classes do not support creating custom event log messages. However, you can shell out with the eventcreate command to create events in other logs. See AlsoMS KB 324145 (HOW TO: Create Custom Events) |