Monitor Event Log in Windows Servers

If you want an ad-hoc solution for this follow the below instructions for pre-Windows7/2008 systems. I realized the script needed some changes For Windows 7/2008 so if you are on those OS then check here.

1. Create a directory to store scripts
   

   mkdir C:\Scripts\events
   

2. Save this script in it. Be sure to update smarthost and to/from addresses
   
3. Create the event trigger that will send the email if any error. It will ask for the password for the domain user the system will use to run the script.
   

   eventtriggers /create /ru domainuser /l "APPLICATION" /tr "All Errors" /t error /tk "C:\scripts\events\sendEventErrorByEmail.vbs\"
   

4. You can either wait for an error to happen or use the below script to insert an error yourself
   

   const SUCCESS = 0
   const ERROR = 1
   const WARNING = 2
   const INFORMATION = 4
   const AUDIT_SUCCESS = 8
   const AUDIT_FAILURE = 16
   
   Dim WshShell
   Set WshShell = WScript.CreateObject("WScript.Shell")
   wshshell.Logevent ERROR, "Test ERROR Event Log"
   set wshshell=nothing
   

5. Use a file (eventLogsExclusionsFilePath="eventLogsExclusions.txt") for those log messages you would like to exclude. Yes sometimes developer log as ERROR stuff that should be logged at different level
6. From now on you will get notified when an error is stamped in the event logs. You can always query the tasks that you have configured to be triggered for events:
   c:\>eventtriggers /query
   

   Trigger ID Event Trigger Name        Task
   ========== ========================= ========================================
            1 Application Errors        C:\scripts\events\sendEventErrorByEmail.vbs"
   

Here is how to get SSL authentication or TLS Authentication support.