I need the exact variable to show me Event ID 1074 - Who rebooted the server last.

I have tried using ${N=SwisEntity;M=AssetInventory.ServerInformation.LastLoggedInUser} but it gives the wrong username.

Based on Event ID 1074 User, I see the correct user who rebooted but I wan to display the user inside my alert email.

Thank you

  • So, I am using the built-in "${NodeName} seems to have rebooted at ${LastBoot}" alert and its working fine. Now, I want it to email me who rebooted it and at what time? Can you please provide me with the full SWQL? I would like to email result to look like this powershell script.       Get-EventLog -LogName System |
    where {$_.EventId -eq 1074} |select-object -first 10 |
    ForEach-Object {
    $rv = New-Object PSObject | Select-Object Date, User, Action, process, Reason, ReasonCode
    if ($_.ReplacementStrings[4]) {
    $rv.Date = $_.TimeGenerated
    $rv.User = $_.ReplacementStrings[6]
    $rv.Process = $_.ReplacementStrings[0]
    $rv.Action = $_.ReplacementStrings[4]
    $rv.Reason = $_.ReplacementStrings[2]
    } | Select-Object Date, Action, Reason, User, Process |ft

  •  did you get this, it would be useful for my new deploment 

Reply Children