Introduction
With our new Monitoring feature on 6.3, you can now monitor the event viewer logs and create notifications and help desk tickets based on those alerts.
However, this does not work for workstations, only servers.
If you would like to be able monitor your workstations in some fashion, below is a method using Custom Inventory Rules and Reporting
Step 1: Getting the data using Custom Inventory Rules
- Create a new software item under Inventory > Software > Choose Action > New
- Give the item a name: Windows Event viewer log - Disk errors
- In the Custom Inventory Rule text box, enter the below:
- ShellCommandTextReturn(cmd /q /c powershell.exe -command "Get-EventLog -LogName System -EntryType Error -Source "*Disk*" -After (Get-Date).AddDays(-1) | format-list -property TimeGenerated ,EventID , Source, UserName ,Message")
- ShellCommandTextReturn(cmd /q /c powershell.exe -command "Get-EventLog -LogName System -EntryType Error -Source "*Disk*" -After (Get-Date).AddDays(-1) | format-list -property TimeGenerated ,EventID , Source, UserName ,Message")
- Highlight the Operating Systems for Windows using Shift+Click or Ctrl+Click
- Click Save
- Under Inventory > Devices, force an inventory on a device
The rule should look like this when you create it:
Once the inventory finishes, you should have data under the Custom Inventory Rule section
Step 2: Setup Notification
You can also setup a Notification under Devices > Notification.
Use the search criteria of:
Windows Event viewer log - Disk errors | > | 0
Give the notification an Email Address you will see what machines have returned data
Step 3: Setup report
When you receive the alert like the above, it doesn't show you what exact error there is.
With a report, you can have it scheduled or ran manually to send you the actual details\
If you want to just download the report, you can download it here:
(updated 4/28)
*Notice i don't have anything in the Errors columns since none of my machines don't have disk errors, which is a good thing :)
If anyone has questions, or runs this rule and gets actual disk error returns, please share in the comments
Comments