Showing results for 
Search instead for 
Did you mean: 
Create Post

Windows Event Log Count-- updated on Sept 9, 2008 (SolarWinds)

Windows Event Log Script

The Windows Event Log script searches the Windows Event log on a computer for specific events that may have occured during a specified time frame, and reports the number of occurrences as an Orion APM statistic.


[-computer computerName] [-area eventArea] [-type eventType] [-id eventID] [-source eventSource] [-exclusions findExclusionText] [-match findMatchText] [-timespan timeSpanMins] [-failmode failmodeType]



Name of the computer whose event logs you want to read. If not specified, the default value is localhost.



Name of the Windows NT Event Log File:  Application, Security, or System.



Name of the event type: Error, Warning, Information, Success, or Failure.



Identifier of the event, specific to the source that generated the event log entry. Used together with the eventSource to uniquely identify a Windows NT event type. The default value is 0.



Name of the source (application, service, driver, or subsystem) that generated the entry. Used together with eventID to uniquely identify a Windows NT event type.



A string of text which, if located by the script, prohibits that event from being counted towards the APM statistic.



A string of text which, if located by the script, counts towards the APM statistic.



The age, in minutes, of the oldest event that the script attempts to locate.


These arguments returns the number of events in the localhost Application event log that have an ID of 1 and that have occured within the last 5 minutes. If any events are found, the component is put into a down state.

-computer localhost -area Application -id 1 -timespan 5

Labels (1)
I like the idea but am sure of how it should work. I have my arguments set to monitor specific a event ID for a host with timespan of 5 minues. The log event was generated in the System log however APM didnt recignize the event that was generated.

Is there something I'm doing wrong?
Ok, So I figured out that I needed to put in the arguments

but I get status unknown with an error stating " Windows script execution errorC:\document and settings\orion\temp.. microsoft vbscript compilation error expected "then"

I have gone through the wmi troubleshooting guide and wmi is fin connecting remotely. Also rpc is enabled, no firewalls are on and I am using win2k3

does anybody have any suggestions? it would be REALLY great if I could get this script to work it would simply be the bees knees

Any chance someone can tell me how to use this please?. I have added APM into Orion and I can add the template to a server I am monitoring however I don't know shere to specify the command or parameters?
HI all!
I am
Why don't see events?
-computer -area Security -id 0

Application Status: Application status is Up
Component Status: Component status is Up
Component Status Details: Component is up. No events Found
Component Type: Windows Script Monitor

Message: No events Found

What is Statistic Data: 6,00 ???
I'm having mixed results with this. First off, I needed to specify the actual computer name instead of putting in "localhost". When I test using localhost, I can see it running against the proper test node, but it never finds any events. If i put in real server name, it will find events.

Secondly, I cannot get the timespan to function properly. No matter what I use, it will always see the event. Even tho the event is days old and I set the timespan to 5 minutes, it still sees it.

My syntax is -timespan 5
Every other variable arguement seems to work just fine.
I have finally got this script to run after logging a call and getting no-where. It is all the &amp and &lt rubbish that is in the script. paulw1978, this will fix your issue.

Version history
Revision #:
1 of 1
Last update:
‎09-09-2008 12:00 AM
Updated by: