Power Shell Script to Schedule a Event Log Notification Through Email
Step 1 : Copy below scripts and paste it in notepad and modified the script.
$HostName = (Get-Wmiobject win32_computersystem).__server
$File1 = "C:\$HostName-System-Error.htm"
$File2 = "C:\$HostName-System-Warning.htm"
$File3 = "C:\$HostName-Application-Error.htm"
$File4 = "C:\$HostName-Application-Warning.htm"
Get-EventLog -LogName "system" -EntryType "error" -After (Get-Date).AddHours(-24) | ConvertTo-HTML | Out-File $File1
Get-EventLog -LogName "system" -EntryType "warning" -After (Get-Date).AddHours(-24) | ConvertTo-HTML | Out-File $File2
Get-EventLog -LogName "application" -EntryType "error" -After (Get-Date).AddHours(-24) | ConvertTo-HTML | Out-File $File3
Get-EventLog -LogName "application" -EntryType "warning" -After (Get-Date).AddHours(-24) | ConvertTo-HTML | Out-File $File4
Send-MailMessage -Attachments $File1,$File2,$File3,$File4 -SmtpServer "your mail-server" -From "$HostName@your domain" -To "reciver@your domain" -Subject "$Hostname Daily Eventlog-Report"
make sure have to enter with in signs " " .
and do not change HostName, it will take automatically from system,as it mentioned 1st line in the script)
and save as .ps1 extension.
Step 2 : If you want to run this file in power shell.
Open power shell as Run as Administrator
Redirect to script file path.
and type ./filename.ps1 ( While running you have to mention ./ before entering filename)
PowerShell says "execution of scripts is disabled on this system."
$HostName = (Get-Wmiobject win32_computersystem).__server
$File1 = "C:\$HostName-System-Error.htm"
$File2 = "C:\$HostName-System-Warning.htm"
$File3 = "C:\$HostName-Application-Error.htm"
$File4 = "C:\$HostName-Application-Warning.htm"
Get-EventLog -LogName "system" -EntryType "error" -After (Get-Date).AddHours(-24) | ConvertTo-HTML | Out-File $File1
Get-EventLog -LogName "system" -EntryType "warning" -After (Get-Date).AddHours(-24) | ConvertTo-HTML | Out-File $File2
Get-EventLog -LogName "application" -EntryType "error" -After (Get-Date).AddHours(-24) | ConvertTo-HTML | Out-File $File3
Get-EventLog -LogName "application" -EntryType "warning" -After (Get-Date).AddHours(-24) | ConvertTo-HTML | Out-File $File4
Send-MailMessage -Attachments $File1,$File2,$File3,$File4 -SmtpServer "your mail-server" -From "$HostName@your domain" -To "reciver@your domain" -Subject "$Hostname Daily Eventlog-Report"
Make changes only where i marked a word in bold color.
make sure have to enter with in signs " " .
and do not change HostName, it will take automatically from system,as it mentioned 1st line in the script)
and save as .ps1 extension.
Step 2 : If you want to run this file in power shell.
Open power shell as Run as Administrator
Redirect to script file path.
and type ./filename.ps1 ( While running you have to mention ./ before entering filename)
PowerShell says "execution of scripts is disabled on this system."
If you're using Windows 2008 R2 then there is an x64 and x86 version of PowerShell both of which have to have their execution policies set. Did you set the execution policy in both hosts?
You can set the execution policy by typing this into your powershell window:
Set-ExecutionPolicy RemoteSigned
Step 3: Schedule in Task Scheduler
Go to Create task.
Mention Name
Check the option in Run with Highest privileges
In Trigger, click new and select daily and specify start time.
In Action, Click New, In Program / Script enter powershell -file "C:\Filename.ps1" (specify file location).
Then click ok twice.
And also refer
http://gallery.technet.microsoft.com/scriptcenter/Export-Windows-event-log-ecdfadfc