Thursday, June 5, 2014

Monitoring Event id thru Powershell

Hi Readers,


We were facing issues with IIS crash on some of the sharepoint servers, so We had written the below script in the link to monitor the crash event id & send us Alert in email if that happens.


 http://gallery.technet.microsoft.com/Event-id-thru-Powershell-4f806dca


Extract the script, schedule it for every 30 minutes( you can reduce this time, we had used it as it was crashing during night so 30 minutes was ok for us)


If you reduce the task scheduler to say 5 minutes than change the parameter in the script as well $daystocheck = [DateTime]::Now.AddMinutes(-5)


 Change the below Parameters:-


$fromadd = “sharepointdown@labtest.com”


$email1=”Messagingsupport@labtest.com”


$email2="phonenumber@vtext.com"  #### example: 123456@vtext.com for verizon


$smtpServer="Smtp server"


$eventid = "5146"


$server_list=@("server1","server2")


-----------------------------------------------------------------------------------------------------------------------------


################################################################
# Author: Vikas Sukhija
# Date: 03/19/2013
# Description: Event ID 5146
# Monitoring for sharepoint servers
################################################################

$fromadd = “sharepointdown@labtest.com”
$email1=”Messagingsupport@labtest.com”
$email2="phonenumber@vtext.com" #### example: 123456@vtext.com for verizon
$smtpServer="Smtp server"

$eventid = "5146"
$daystocheck = [DateTime]::Now.AddMinutes(-30)

$server_list=@("server1","server2")

$server_list | foreach-object {

$data = @()

$record=Get-WinEvent -ComputerName $_ -LogName system -MaxEvents 100
$record
$coll = $record | where{($daystocheck -le $_.TimeCreated) -and ($_.id -eq $eventid)}
write-host "-------------------------------------------" -foregroundcolor green
$coll
if($coll -ne $null)

{

$msg = new-object Net.Mail.MailMessage
$smtp = new-object Net.Mail.SmtpClient($smtpServer)

#Mail sender
$msg.From = $fromadd
#mail recipient
$msg.To.Add($email1)
$msg.To.Add($email2)
$msg.Subject = "$eventid Crash $_"
$smtp.Send($msg)

}

}

################################################################

Regards


Sukhija Vikas


http://msexchange.me

2 comments:

  1. Hello Vikas,

    Thanks for sharing the script.

    Dhanushka

    ReplyDelete
  2. […] http://msexchange.me/2014/06/05/monitoring-event-id-thru-powershell/ […]

    ReplyDelete