event monitor and reboots

Hey Guys,

i need some advice and if possible some help.

In out organization when we reboot systems after patching them everymonth, we have to manually login in and check the event monitor for anay failed events and all.

Is there any way I can write a script or something and have some pre determined services to be monitored or somehting ?

Or is there any centralized (preferably open source) event monitor software ? I am trying to do it with splunk but anythign open source?

pelase let me know
thanks
rj

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

undomiel

Here's a powershell script that will do some event log searching for you. Mind you, requires powershell to be installed.

This will pull any errors out from the first 100 entries in the log, though you can modify that number of course.

$Log="System"
$args | foreach-object {
write-output "Client name: $_"
$EventLog = new-Object System.Diagnostics.EventLog($Log, $_)
$EventLog.entries | select -first 100 | where {$_.entryType -match "Error"}
}

Toss it in a file and execute the file name with arguments i.e.
querylog.ps1 client1 client2 client3 ...

ranjitcool

Thanks undomiel for the script, so I can execute this from my system to a target server, what about the login credentials?

rj

undomiel

Accidentally left out the first line of the script, my mistake. You would need an account that has admin privileges to the machine.

ranjitcool

Hey Undomiel, i did not get by what u meant first line of your script?

please let me know
thanks
rj