Disaster Admin

It is not secret I am a big fan of saving time and using existing tools to complete repetitive tasks. If you are like me, then I have a tip for you. Windows Management Instrumentation (WMI). WMI allows you to locally or remotely manage workstations and servers running a Microsoft Windows operating systems. Best of all its already installed in all versions of Windows since 2000.

Why am I so over the moon about WMI? Glad you asked. I use to automatically send a report of event logs to my In-box everyday. By the time I arrive to work in the morning, I have waiting for me, an HTML file with all of errors on every server I manage for the last 24 hours. I can scan though them in about fifteen minutes and know whether I need to give something my attention or put it on a to do list. Want to know how you can do it? Of course you do, read on and I will show you.

What I am going to explain to you is a tiny fraction of how WMI could be applied. A full list of commands and uses can be found over at http://ss64.com/nt/wmic.html. I am querying the existing logs on a server for warning and error messages, capturing it, formatting for easy viewing, and then sending it though email, via a visual basic script. Trust me, it is easier than it sounds.

Jumping right in as I like to do, lets break down the script into parts. The first part is setting the date to yesterday, and setting your event log and warning level and output file. The second part sets up the formatting of the output file and the then use WMI to query and capture the events we are looking for. Lastly we will send the events captured to the HTM file and email it to recipients for review. I have included all of the files needed in a zip, download here.

Setting the Date and Output

set "evtlog=application" You can change 'application' to be any of the available windows logs
set "source=error" You can change 'error' to any of the different error levels. Information, Warning, or Error
set /a MM=%date:~4,2% This sets the month to the current month.
set /a DD=%date:~7,2% -1 This sets the day to the current day, minus one, or yesterday
set /a YYYY=%date:~10,4% This sets the year to the current year.
Set "zOutPut=c:\Logs\EventLog.htm" Sets the output file to EventLog.htm in the folder C:\Logs

Formatting the Output File

There is a lot going on here. This is were the HTML formatting happens, as well as setting the header of the file and labels for what event log and level of error you are querying for. If you want to adjust the colors on the output, this is where you do it.

>"%zOutput%" (
echo.^<html^>
echo.^<body^>
echo.^<H3^>^<Font Face=Verdana Color=Blue^>^<P align=Center^>%date% - %time%^<BR^>
echo.Query %evtLog% events^</Font^>^</H3^>^</P^>
echo.^<HR^>
echo.^</html^>
echo.^</body^>
)
>>"%zOutPut%" (
echo.^<Font Color=Green^>^<H3^>^<B^>^<I^>Event Log = %evtlog%^</Font^>^</H3^>^</B^>^</I^>
echo.^<Font Color=Green^>^<H3^>^<B^>^<I^>Warning Type = %source%^</Font^>^</H3^>^</B^>^</I^>
)

Below is the meat of the script, where the magic happens if you will. Because we want to get the events for multiple servers, there needs to be a list of servers to search against. This is accomplished by using a text file (servers.txt) with a list of server names and a FOR command.

This says, for each entry in servers.txt do the following: Search the application log for error messages that happened in the last 24 hours and order by date and time.

FOR /F %%A IN (servers.txt) DO (
WMIC /node:%%A /append:"%zOutPut%" NTEVENT WHERE "logfile='application' AND Type='error' AND TimeGenerated >='%MM%/%DD%/%YYYY%'" GET LogFile, CategoryString, SourceName, EventCode, Type, Message, TimeGenerated /format:hform:"sortby=TimeGenerated" > NUL
)

One Note in this section. I had to modify the “format:hform” for work correctly on a Vista workstation. Originally the line was “ format:hform.xsl”, but it was not working. Once I removed the “.xsl” the script worked correctly. You may need to play around with adding that back in if you are using a pre-2008 server or Vista operating system.

Creating the Output File

Here is where the HTM file is populated with data and a footer note with the data and time is added.

:Cleanup
>>"%zOutput%" (
echo.^<I^>^<Font Size=-1^>^<BR^>%zver%
date /t
time /t
echo.- %username% ^</I^>
)
::cls&echo Done
(ping 127.0.0.1 -n 1)>nul
start email.vbs

Emailing the Results

Lastly, we need to send the log reports to an Inbox. This is accomplished by using a visual basic script that attached the HTM file to an email and relays it to the recipients. For this to work you are going to need an email server that you can relay off of. I have an internal email server that I can relay off of. If you do not have a relay to use, you could still use the above script and manually go to where the HTM file is created and view it. I like the email option because its harder to forget to look at logs if they show up in your In-box each morning.

Set objMessage = CreateObject("CDO.Message")
objMessage.Subject = "This is where you add your subject"
objMessage.From = "disasterroy@fakeemail.com"
objMessage.To = "reciepient@fakeemail.com"
objMessage.TextBody = "Add any text you want to appear in the body of your email here."
objMessage.AddAttachment "Add the location of your EventLog.htm file here C:\Logs\EventLog.htm"
objMessage.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
objMessage.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "Add the name of the email server you are going to relay off of here"
objMessage.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
objMessage.Configuration.Fields.Update
objMessage.Send

Looking at it laid out on the screen here, the learning curve on this might seem a little high. The important things to focus on are the list of servers in the text file, the the event log and error level setting. Last but not least, the visual basic email script. The rest should pretty much work out of the box.