SCOM – Check for missing event

Snir Hoffman

06/09/2009

Hello OpsMgr fans,

I really tried to use the missing event feature to monitor missing events but couldn’t make it work.

The case is that one of my clients has a very sadly developed program. The server needs to be in a logged state all the time and the program does not output its error anywhere.

The only way to know that it is working is to make sure those print events are created all the time.

For that I wrote a code that should come inside a monitor to check if in the last x minutes a certain event was created.

I combined into the script a time filter so you can filter that no error should appear in the weekend.

Follow this Link to learn how to create a script based monitor.

Enjoy.

The Code:

Option Explicit

On Error Resume Next

' OpsMgr Event-related Constants

Const EVENT_TYPE_ERROR = 1

Const EVENT_TYPE_WARNING = 2

Const EVENT_TYPE_INFORMATION = 4

Dim oAPI, oBag, sCount, sEventCode, sSourceName, dtmStartDate, DateToCheck, strComputer, objWMIService, colEvents, sDay, sChecktime

Set oAPI = CreateObject("MOM.ScriptAPI")

Set oBag = oAPI.CreateTypedPropertyBag(3)

' Checking for time window

sDay = Weekday(Date)

If sDay = 7 Then WScript.Quit 'Do not run on Saturday

sChecktime = "null"

Call Checktime ()

If sChecktime = "OK" Then

Const CONVERT_TO_LOCAL_TIME = True

Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")

DateToCheck = CDate(Now()-0.01) ' How long back to check, eq to 14.4 minutes

dtmStartDate.SetVarDate DateToCheck , CONVERT_TO_LOCAL_TIME

strComputer = "."

sEventCode = 10 ' Event ID to check

sSourceName = "Print" ' Event Source to check

Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")

Set colEvents = objWMIService.ExecQuery ("Select * from Win32_NTLogEvent Where TimeWritten _
>= """ & dtmStartDate & """ and EventCode = "& sEventCode & " and SourceName = """ _
& sSourceName & """")

sCount=0

For each objEvent in colEvents

'WScript.Echo "Category: " & objEvent.Category ' For troubleshooting

'WScript.Echo "Computer Name: " & objEvent.ComputerName' For troubleshooting

'WScript.Echo "Event Code: " & objEvent.EventCode ' For troubleshooting

'WScript.Echo "Message: " & objEvent.Message ' For troubleshooting

'WScript.Echo "Record Number: " & objEvent.RecordNumber ' For troubleshooting

'WScript.Echo "Source Name: " & objEvent.SourceName ' For troubleshooting

'WScript.Echo "Time Written: " & objEvent.TimeWritten ' For troubleshooting

'WScript.Echo "Event Type: " & objEvent.Type ' For troubleshooting

'WScript.Echo "User: " & objEvent.User ' For troubleshooting

'WScript.Echo objEvent.LogFile ' For troubleshooting