Synchronized Logging Through Script

Author Message
Revenge

  • Total Posts : 17
  • Scores: 0
  • Reward points : 0
  • Joined: 9/3/2004
  • Location:
  • Status: offline
Synchronized Logging Through Script Friday, March 04, 2005 8:04 AM (permalink)
0
Ok i am very new to vbs, im not sure if you guys will be able to help me or not but here it goes. My Boss wants me to come up with a script that allows him to take Event Logs from all different servers and combine them into one file.. I did a search and was able to find something pretty much exactly what i was looking for :
<?XML version="1.0"?>

<package>
<job id="Default">
<script language="jscript">
<![CDATA[
function GetUTCInfo() {
var d, s;
d = new Date();
s = d.getUTCFullYear()+"";
s += PadZero(d.getUTCMonth()+1)+"" ;
s += PadZero(d.getUTCDate())+"";
s += PadZero(d.getUTCHours())+ "";
s += PadZero(d.getUTCMinutes())+ "";
s += PadZero(d.getUTCSeconds())+ "";
return(s)
}
function PadZero(intDay) {
if (intDay < 10)
return (0 + "" + intDay);
else
return (intDay);
}

</script>
<script language="VBScript">
<![CDATA[

Dim strComputerName,objWshNetwork,strDateStamp, arrHosts, i
Dim strOpPath, cstrQ, cstrQCQ, s, Counter, intTime

CONST ForReading = 1, ForWriting = 2, ForAppending = 8

'********************************************************************
'Change the values in this section to reflect your local           '*
'environment.                                                      '*
'********************************************************************
CONST SLAHosts = "EventHosts.txt"                                  '*
CONST ErrLog = "Error.log"                                         '*
CONST ScriptLog = "EventLog.log"                                   '*
'********************************************************************

Public LogFile
Public ErrorFile
Public objFSO

strOpPath = ExecutingFrom
CheckScriptHost
s=GetUTCInfo(s)
Counter=0
'This is thousandths of a second
intTime=3000

Set objFSO = CreateObject("scripting.FileSystemObject")

arrHosts = HostsToMonitor (strOpPath & SLAHosts,";")

For i=0 to UBound(arrHosts)
'What time is it now? Recalc the value of s
s=GetUTCInfo(s)
'You get a unique error file for each UTC day
ErrorFile = strOpPath & Left(s,8) & ErrLog

If strOpPath <> "" Then
LogFile = strOpPath & Left(s,8) & ScriptLog
Else
LogFile = strOpPath & Left(s,8) & ScriptLog
End if

If Not IsEmpty(arrHosts(i)) Then
wscript.echo arrHosts(i) & " " & Left(s,12)
LogAction "Monitoring " & arrHosts(i)
AsynchEvents(arrHosts(i))
End If
Next

strHeader = "[ Date & Time ] --, Record Number, LogFile, " & _
"Event Identifier, Event Code, Source Name, Type, Category, " & _
"User, ComputerName, Message" ', Insertion Strings, Data"
LogAction strHeader

'wait for however long intTime is before starting this loop
'again
'Counter is a variable that will not be set to 1
'thus we loop until physically interrupted (Ctrl-C)
Do Until Counter=1
wscript.sleep(intTime)
s=GetUTCInfo(s)
If strOpPath <> "" Then
LogFile = strOpPath & Left(s,8) & ScriptLog
Else
LogFile = strOpPath & Left(s,8) & ScriptLog
End if
If NOT objFSO.FileExists(LogFile) Then
LogAction(strHeader)
End If
If Counter=1 Then
Exit Do
End if
Loop
'====================================================================
Sub SINK_OnObjectReady(objObject, objAsyncContext)
WScript.Echo (objObject.TargetInstance.ComputerName) & ", " & _
(objObject.TargetInstance.Message)

strLogEntry=(objObject.TargetInstance.RecordNumber) & ", " & _
(objObject.TargetInstance.LogFile) & ", " & _
(objObject.TargetInstance.EventIdentifier) & ", " & _
(objObject.TargetInstance.EventCode) & ", " & _
(objObject.TargetInstance.SourceName) & ", " & _
(objObject.TargetInstance.Type) & ", " & _
(objObject.TargetInstance.Category) & ", " & _
(objObject.TargetInstance.User) & ", " & _
(objObject.TargetInstance.ComputerName) & ", " & _
(objObject.TargetInstance.Message)
LogAction strLogEntry
End Sub
'====================================================================
Sub AsynchEvents(strComputer)

On Error Resume Next

Set services = GetObject("WinMgmts:{impersonationLevel=impersonate, (security)}!\\" & _
strComputer)
If Err <> 0 Then
LogAction "Setting Remote Event Log Monitoring on " & strComputer & _
" failed. Error Number: " & Err.Number & ", Error Description: " & _
Err.Description
Err.Clear
Exit Sub
End If
Set sink = WScript.CreateObject("WbemScripting.SWbemSink","SINK_")
services.ExecNotificationQueryAsync sink, _
"select * from __instancecreationevent where targetinstance isa 'Win32_NTLogEvent'"

On Error GoTo 0

End Sub
'====================================================================
Sub LogAction (strEntry)

Dim strErrMsg, f

On Error Resume Next

set f = objFSO.OpenTextFile(LogFile, ForAppending, True, -2)

f.WriteLine "[" & Now() & "] -- " & strEntry
If Err <> 0 Then
'write to error log
set f = objFSO.OpenTextFile(ErrorFile, ForAppending, True, -2)
strErrMsg="Could not write to LogFile. " & Err.Number & " " & _
err.Description & ". Attempting to write: " & strEntry
f.WriteLine strErrMsg
End if
wscript.echo "Error Occurred: " & strErrMsg
err.clear
End If

f.close

On Error Goto 0

End Sub
'====================================================================
Function SurveyHost()

Dim strComputer, objWshNetwork

If(WScript.Arguments.Count) Then
strComputer = WScript.Arguments.Item(0)
Else
Set objWshNetwork = WScript.CreateObject("WScript.Network")
strComputer = objWshNetwork.ComputerName
Set objWshNetwork = Nothing
End If

SurveyHost=strComputer

End Function
'====================================================================
Function ErrorLogName()

ErrorLogname=ExecutingFrom & Left(s,8) & ErrLog

End Function
'=======================================================
Function HostsToMonitor(HostSource, strComment)

Dim ts,tsLine,arrLines

On Error Resume Next

Redim arrLines(0)

Set ts=objFSO.OpenTextFile(HostSource,ForReading,False)
If Err <> 0 Then
'SurveyHost function identifies host to monitor
arrLines(0)=SurveyHost
HostsToMonitor=arrLines
Err.Clear
Exit Function
End If

Do While NOT ts.AtEndOfStream
tsLine = Trim(ts.ReadLine)
If tsLine <> "" AND (Left(tsLine,1) <> strComment) Then
Boundary=UBound(arrLines)
Redim Preserve arrLines(Boundary +1)
arrLines(Boundary)=tsLine
End If
Loop
ts.Close

HostsToMonitor=arrLines

End Function
'=======================================================
Function ExecutingFrom()

Dim strScriptPath

strScriptPath=Left(wscript.scriptfullname, _
Len(wscript.scriptfullname)-Len(wscript.scriptname))

If Right(strScriptPath,1) <> "\" Then
strScriptPath=strScriptPath & "\"
End If

ExecutingFrom=strScriptPath

End Function
'====================================================================
Sub CheckScriptHost()

If InStr(LCase(wscript.fullname),"cscript") = 0 Then
strMsg = "Script must be run by CScript.exe. Terminating this " & _
"script, changing the default script engine and restarting" & _
" execution."
Dim objShell
Set objShell=CreateObject("wscript.shell")
strExec = "cscript.exe //NoLogo //H:cscript //S"
objShell.Run strExec,0,TRUE

strExec ="cscript.exe " & Chr(34) & _
wscript.scriptfullname & Chr(34)'& " " & _
'        Chr(34) & strArg & Chr(34) & Chr(34)

objShell.Run strExec,,False
Wscript.Quit
End If

End Sub
'====================================================================
]]>
</script>
</job>
</package>

Now this is the part where I am a total n00b at scripting, I am pretty good with VB6 but with scripting I do not understand what I would save this as (I typed this all up in NotePad), like what type of extension, and then where i would run it and where I would look to get its information. I know this has VBScript and some JScript together, but I am hoping that someone still can help me. If there are any further questions you have about my problem just ask me.
Thanx in Advance,
-Revenge

P.S. I found this code at http://pubs.logicalexpressions.com/Pub0009/LPMArticle.asp?ID=267
It was an awsome article by Greg Chapman.
 
#1
    mbouchard

    • Total Posts : 2110
    • Scores: 29
    • Reward points : 0
    • Joined: 5/15/2003
    • Location: USA
    • Status: offline
    Re: Synchronized Logging Through Script Friday, March 04, 2005 8:42 AM (permalink)
    0
    Taking a look at the link and at the header and footer of the code it seems that this is a WSF file. The name used in the article is Win32EventRealTime.wsf
     
    #2
      Revenge

      • Total Posts : 17
      • Scores: 0
      • Reward points : 0
      • Joined: 9/3/2004
      • Location:
      • Status: offline
      Re: Synchronized Logging Through Script Friday, March 04, 2005 9:21 AM (permalink)
      0
      Thank you Mike, i saved it as a .wsf but now when i run it it gets an error and a box pops up and says:

      Script: <drive letter>:\<path>\Win32EventRealTime.wsf
      Line: 25
      Char: 4
      Error Syntax error
      Code 800A03EA
      Source: Microsoft JScript compilation error

      I know that syntax error basically means a spelling error or wrong usage of a code, but i dont see how the </script> is being used in the wrong syntax here, I have been trying to use the debugger also but I can not seem to be getting it to work.
      Any Ideas?
       
      #3
        token

        • Total Posts : 1917
        • Scores: 0
        • Reward points : 0
        • Joined: 1/14/2005
        • Location:
        • Status: offline
        Re: Synchronized Logging Through Script Friday, March 04, 2005 10:32 AM (permalink)
        0
        Combine event logs into one file ? .txt file ? What about the different logs (app, system, sec) ? How should they be arranged to fit into one file while the contents have different log types and from different servers ?

         
        #4
          jbuttery

          • Total Posts : 24
          • Scores: 0
          • Reward points : 0
          • Joined: 11/3/2004
          • Location:
          • Status: offline
          Re: Synchronized Logging Through Script Friday, March 04, 2005 2:18 PM (permalink)
          0
          Tell your boss he needs to spend $180 on Sapien PrimalScript 3.1. Do you use Notepad for writing VB6 code?
           
          #5
            tnoonan

            • Total Posts : 364
            • Scores: 0
            • Reward points : 0
            • Joined: 12/14/2004
            • Location:
            • Status: offline
            Re: Synchronized Logging Through Script Friday, March 04, 2005 2:49 PM (permalink)
            0
            Respectfullyl disagree. When Creating first web site was told to use frontpage or macromedia. Old Tech told me to write it by hand. You will get more out of it. And after creating my first web site by hand I totaly agree.
             
            #6
              tnoonan

              • Total Posts : 364
              • Scores: 0
              • Reward points : 0
              • Joined: 12/14/2004
              • Location:
              • Status: offline
              Re: Synchronized Logging Through Script Friday, March 04, 2005 2:52 PM (permalink)
              0
              Respectfullyl disagree. When Creating first web site was told to use frontpage or macromedia. Old Tech told me to write it by hand. You will get more out of it. And after creating my first web site by hand I totaly agree.
               
              #7
                token

                • Total Posts : 1917
                • Scores: 0
                • Reward points : 0
                • Joined: 1/14/2005
                • Location:
                • Status: offline
                Re: Synchronized Logging Through Script Friday, March 04, 2005 4:15 PM (permalink)
                0
                Monitoring events in real-time using any scripts could be very resource intensive, especially when event logs are configured to capture large amount of data; something I would've avoided in the first place. On top of that, multiple servers were included.

                Again, depends on the type of resources that are required to be monitored and the number of logs and servers, I would suggest the alternatives of using 3rd party utilties designed for this purpose. It might make your life easier on the long run.

                 
                #8
                  Cobalt

                  • Total Posts : 17
                  • Scores: 0
                  • Reward points : 0
                  • Joined: 2/3/2005
                  • Location:
                  • Status: offline
                  Re: Synchronized Logging Through Script Saturday, March 05, 2005 3:42 PM (permalink)
                  0
                  In answer to the question asked: What does the error 800A03EA mean?

                  In this context it means that you need to remove the text '<![CDATA[' from the script in the two locations where it exists.


                  And as a response to the question of IDE: Depends on what I'm doing. Sometimes I use some form of IDE, sometimes I use notepad. Just depends on what my end goal is and how much time I think it's going to take to complete. Although I must say that I do not write VB6/VB.NET code in notepad. :)
                   
                  #9
                    jbuttery

                    • Total Posts : 24
                    • Scores: 0
                    • Reward points : 0
                    • Joined: 11/3/2004
                    • Location:
                    • Status: offline
                    Re: Synchronized Logging Through Script Sunday, March 06, 2005 12:27 PM (permalink)
                    0
                    Well, sorry I was misinterpreted as being a smart-ass. I was just trying to say that it was an opportunity to get a decent tool.

                    Suppose you're in a meeting with 8 people (incl yourself) earning $100K a year. So you're spending almost $7 a minute discussing anything ($14 a minute, if you believe they would be doing productive work elsewhere). If you spend half an hour discussing a $300 problem the company just lost $120.

                    I've slashed and brute-forced my way to providing solutions since DOS 3 and every PC I work on has a hot-key to the command prompt. If I can get the results I want in 5 minutes using findstr in a batch file versus 15 minutes using regular expressions in script, I choose the former.
                     
                    #10
                      tnoonan

                      • Total Posts : 364
                      • Scores: 0
                      • Reward points : 0
                      • Joined: 12/14/2004
                      • Location:
                      • Status: offline
                      Re: Synchronized Logging Through Script Sunday, March 06, 2005 2:12 PM (permalink)
                      0
                      [:o)]
                       
                      #11
                        Revenge

                        • Total Posts : 17
                        • Scores: 0
                        • Reward points : 0
                        • Joined: 9/3/2004
                        • Location:
                        • Status: offline
                        Re: Synchronized Logging Through Script Monday, March 07, 2005 7:46 AM (permalink)
                        0
                        Thank you for the input guys, I am not saying i have to do it in notebook, I am just not sure of any programs that i can write scripts in (No i do not write VB6 code in notepad, i write it in the VB6 program :P) and if some one knows of such a scripting program do they also know of some keys codes that I will need to know to do this task, my main problem is i dont understand everything that the code i originally posted is doing....
                        Thank You
                         
                        #12

                          Online Bookmarks Sharing: Share/Bookmark

                          Jump to:

                          Current active users

                          There are 0 members and 1 guests.

                          Icon Legend and Permission

                          • New Messages
                          • No New Messages
                          • Hot Topic w/ New Messages
                          • Hot Topic w/o New Messages
                          • Locked w/ New Messages
                          • Locked w/o New Messages
                          • Read Message
                          • Post New Thread
                          • Reply to message
                          • Post New Poll
                          • Submit Vote
                          • Post reward post
                          • Delete my own posts
                          • Delete my own threads
                          • Rate post

                          2000-2012 ASPPlayground.NET Forum Version 3.9