Recipe8.1.Creating an Event

Recipe 8.1. Creating an Event

Problem

You want to write an event to an event log. This can be useful if you want to document certain actions you've performed on a server.

Solution

Using a command-line interface

The following command is available on Windows Server 2003:

> eventcreate /T <EventType> /ID <EventID> /L <LogName> /SO <EventSource> /D  "<EventDescr>"

The following command writes an event to the Application event log with event ID 999 and source SysAdmin:

> eventcreate /T INFORMATION /ID 999 /L APPLICATION /SO SysAdmin /D "Restarting server after service pack install"

The logevent tool, which is available in the Windows 2000 Resource Kit, can also be used to create events:

> logevent -s <EventType> -e <EventID> -r <EventSource> "<EventDescr>"

This example is equivalent to the eventcreate example where I created an event in the Application log:

> logevent -s I -e 999 -r SysAdmin "Restarting server after service pack install"

Using VBScript

' This code creates an event in the Application event log. ' ------ SCRIPT CONFIGURATION ------ strServer = "\\<ServerName>" ' e.g., fs01  strDescr = "<EventDescr>"    ' e.g., Restarting server after service pack install ' ------ END CONFIGURATION --------- Const EVENT_SUCCESS = 0 Const EVENT_ERROR   = 1  Const EVENT_WARNING = 3 Const EVENT_INFO    = 4     set objWSHShell = Wscript.CreateObject("Wscript.Shell") boolRC = objWSHShell.LogEvent(EVENT_INFO, strDescr, strServer)     if boolRC = TRUE then    WScript.Echo "Successfully created event." else    WScript.Echo "Failed to create event." end if

Discussion

Most Windows administrators use the event log as a passive tool, whereby they periodically scan the logs to see if there are any issues that need attention. You can, however, use the event logs in a more active capacity by documenting actions you perform on a server or configuration changes you make. With the command-line solutions I described, it is very easy to create a custom event message. You should consider creating an event every time you perform some significant action on a server, such as installing a new application. This uses the event logs as a poor man's change management system.

Using a graphical user interface

None of the graphical tools (e.g., Event Viewer snap-in) allow you to create custom event log messages.

Using a command-line interface

To create an event on a remote machine, specify the /S option followed by the host name for eventcreate, and specify -m followed by \\ and the hostname for logevent. Use /U and /P to specify an alternate user account and password, respectively, with eventcreate (there are no similar options for logevent).

Using VBScript

With WSH, you can create an event only in the Application log. The WMI Event Log classes do not support creating custom event log messages. However, you can shell out with the eventcreate command to create events in other logs.