Email Alert for Event Logs

neeraj21 · 2020-08-04T14:02:32.000Z

Hi,I have written a Powershell script for my Windows server where it will search for a particular event for last 1 hr and will send the email.Script is working fine but it is sending the email in case of no error detection also with a blank entry.I want no email in case of no issues. Please help as I am very new in Powershell.Below is the script which I created.#####################################################Function SendEevntLogDetails{ param ( $strFilePath ) $MailBody=“Hi Team, Following is the list of errors for the Custom Logs of Stream & Disbursement Portal.” $Logs= Get-Content “$strFilePath\CustomLogs.txt” $ $head= “$style” $MachineName=“xxxxxxxxx” foreach($log in $Logs) { $tableBOdy= “$styleServerNameSourceEntryTypeEventIdMessage” $MailBody+= “Machine Name:$MachineName EventLog:$log " $EntryType=@(“Error”) $EventlOGS= Get-EventLog -LogName $log -EntryType $EntryType -After (Get-Date).AddHours(-1) -InstanceID 998 # Get the event Log Details foreach($Event in $EventlOGS) { $Entry=$Event.EntryType $EventId=$Event.EventID $Message=$Event.Message if($Entry -eq “Error”) { $Message=”$Message" } $Source=$Event.Source $tableBOdy += “$MachineName$Source$Entry$EventId$Message” } $tableBOdy=$tableBOdy+“” $html=“$head$tableBOdy” $MailBody += $html $MailBody += “Thank YouRegards,Admin Team” } [string]$Subject= “Stream & Disbursement Portal Event log Notification” [string]$users = “neerajk.bit@gmail.com” [string]$fromemail = “testmail@gmail.com” [string]$server = “XXXXXXXX” [string]$SMTPserver = “XXXXXXXXX” send-mailmessage -from $fromemail -to $users -subject $Subject -BodyAsHTML $MailBody -priority High -smtpServer $SMTPserver Write-Host “Mail Sent successfully…!!!” } #####################################################

Neally · 2020-08-04T14:32:34.000Z

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don’t say “Need help” or “PowerShell Help”, actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy…

neeraj21 · 2020-08-04T14:51:19.000Z

Thanks Neally for your quick response.
Will be surely following it next time onwards.

Just if someone help me with this current issue.

Thanks!!

Neally · 2020-08-04T15:25:30.000Z

Please fix it, your code is super hard to read. Help us help you.

Neeraj21:

but it is sending the email in case of no error detection

how did you set it up? you can add a condition, if the condition is not met, it wont send the mail.

$testCondition = # some test
if($testCondition){
    send-mailmessage
}

ryan-netwrix · 2020-08-04T16:11:25.000Z

Neally is correct - code you’ve posted is unreadable. I can see that you are trying to send mail via gmail, so I suggest you to check script by JitenSh from How to send mail from gmail to another gmail using powershell thread.

You can create Task triggered by EventID in Event Viewer (note that “Send an e-mail” function is deprecated since Server 2012 , so you’ll have to use a workaround ):

$SmtpClient = new-object system.net.mail.smtpClient
$MailMessage = New-Object system.net.mail.mailmessage
$SmtpClient.Host = "SMTP.YOURcompany.com"
$mailmessage.from = ("DoNotReply_ToThisEmail@YOURcompany.com ")
$mailmessage.To.add(" Person@ YOURcompany.com , Person2@ YOURcompany.com, …… ")
$mailmessage.Subject = “Alert Subject”
$mailmessage.Body = “Alert Body with Instruction to recipients”
$smtpclient.Send($mailmessage)

I suppose you need something like this - Monitoring Event Logs with PowerShell and How to Make Automatic User Account Reports: PowerShell

How to Automate PowerShell Scripts with Task Scheduler might be usefull as well.

I recommend you to check PowerShell tutorials compilation here on SpiceWorks - we`'ve posted a lot of useful articles.

If you are interested in meeting the goals (instead of tinkering with PowerShell) - try Netwrix Event Log Manager freeware tool, which collects, consolidates and archives Windows server logs, also it alerts you in real time about critical events, based on a configurable list of event IDs:

If you are actually interested in security intelligence about what’s going on in Active Directory and Group Policy use Netwrix Auditor for Active Directory - after 20 days of free trial you can either purchase commercial license or switch to Free Community Edition, which might also suite your case perfectly

BTW,

Here’s PowerShell Send-MailMessage sample for Gmail. Tested and working solution:

Just change $EmailTo, and username/password in $SMTPClient.Credentials… Do not include @gmail.com in your username.

$EmailFrom = "notifications@somedomain.com"
$EmailTo = "me@earth.com"
$Subject = "Notification from XYZ"
$Body = "this is a notification from XYZ Notifications.."
$SMTPServer = "smtp.gmail.com"
$SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 587)
$SMTPClient.EnableSsl = $true
$SMTPClient.Credentials = New-Object System.Net.NetworkCredential("username", "password");
$SMTPClient.Send($EmailFrom, $EmailTo, $Subject, $Body)

ryan-netwrix · 2020-08-04T16:15:01.000Z

Neally:

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum!

@alexw , in Neeraj21s defence - quite often I am unable to use </> button as it breaks message formatting, puts the code block in wrong places, etc.

Neally · 2020-08-04T16:21:56.000Z

Ryan (Netwrix):

Neally:

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum!

Neally, in Neeraj21s defence - quite often I am unable to use </> button as it breaks message formatting, puts the code block in wrong places, etc.

that’s usually only the case if you edit a post, if you write one, I don’t usually have an issue.

@ryan-netwrix

neeraj21 · 2020-08-05T02:15:37.000Z

Thanks a lot Neally & Ryan.
Adding condition while sending email alert has worked for me.

Thank you so much!!

rupesh-lepide · 2020-08-05T08:21:55.000Z

Glad to see your issue has been resolved.

Additionally, you can save your lot of time by using Event Log Manager (Freeware version available) to manage all events from one console and create alerts for specific events.