Collect local event logs 1

[pinkpanther56]

Is there a way to query local event logs for certain Events and collect them?

I've enabled some software restriction policies on our XP stations and I'd like to find out when the policy is blocking exe's but the events are logged locally. As we have about 500 desktops it's not easy to get around them all.

Can this be done with WMI scripts?

Thanks.

 

[linney]

Can this do anything for you?

"Eventtriggers

Displays and configures event triggers on local or remote machines.

To view the command syntax, click a command:

eventtriggers create

Creates a new event trigger that monitors and acts upon the occurrence of log events of given criteria".

Eventtriggers

http://www.microsoft.com/resources/.../xp/all/proddocs/en-us/eventtriggers.mspx#top

Have a look at the Server Forums too.

http://www.tek-tips.com/threadminder.cfm?pid=1674

http://www.tek-tips.com/threadminder.cfm?pid=931

 

[linney]

This mentions Microsoft's MOM, which you may like to explore?

http://www.google.com/search?q=Microsoft's+MOM&rls=com.microsoft

 

[pinkpanther56]

The event triggers won't do what I want here but they might come in usefull thanks.

I wish we could affort MOM.