I mucked with it a little more, and made some changes.
Moved the send_email fuction up (duh!)
I didn't like that the event source was hard-coded, so I changed the monitored_events file to a .csv.
It now uses monitored_events.csv to specify source/id pairs that it will alert on.
I added a couple of switch parameters.
-showevents will display the monitored events found for each server along with the count and timer stats.
-noemail will suppress sending emails.
Made a couple of minor changes to variable names for consistency.
I don't have access to an smtp relay right now, so I can't really test it all. If it tests out OK, we'll put it in the Script Center.
## Powershell Log Monitor Script ##
## Contributing authors - mck74, mjolinor,
param([switch]$ShowEvents = $false,[switch]$NoEmail = $false)
$log = "Security"
$hist_file = $log + "_loghist.xml"
$seed_depth = 200
#run interval in minutes - set to zero for runonce.
$run_interval = 0
$EmailFrom = "<user@domain.tld>"
$EmailTo = "<user@domain.tld>"
$EmailSubject = "Server event notification"
$SMTPServer = "smtp.server.net"
$SMTPAuthUsername = "username"
$SMTPAuthPassword = "password"
$computers = @(gc monitored_computers.txt)
$event_list = @{}
Import-Csv alert_events.csv |% {$event_list[$_.source + '#' + $_.id] = 1}
#see if we have a history file to use, if not create an empty $histlog
if (Test-Path $hist_file){$loghist = Import-Clixml $hist_file}
else {$loghist = @{}}
$timer = [System.Diagnostics.Stopwatch]::StartNew()
function send_email {
$SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 25)
$SMTPClient.Credentials = New-Object System.Net.NetworkCredential("$SMTPAuthUsername", "$SMTPAuthPassword")
$SMTPClient.Send($EmailFrom, $EmailTo, $EmailSubject, $EmailBody)
}
#START OF RUN PASS
$run_pass = {
$EmailBody = "Log monitor found monitored events. `n"
$computers |%{
$timer.reset()
$timer.start()
Write-Host "Started processing $($_)"
#Get the index number of the last log entry
$index = (Get-EventLog -ComputerName $_ -LogName $log -newest 1).index
#if we have a history entry calculate number of events to retrieve
# if we don't have an event history, use the $seed_depth to do initial seeding
if ($loghist[$_]){$n = $index - $loghist[$_]}
else {$n = $seed_depth}
Write-Host "Processing $($n) events."
#get the log entries
$log_hits = Get-EventLog -ComputerName $_ -LogName $log -Newest $n |
? {$event_list[$_.source + "#" + $_.instanceid]}
#save the current index to $loghist for the next pass
$loghist[$_] = $index
#report number of alert events found and how long it took to do it
if ($log_hits){
$events_found = $true
$hits = $log_hits.count
$EmailBody += "`n Alert Events on server $($_)`n"
$EmailBody += $log_hits | fl | Out-String
}
else {$hits = 0}
$duration = ($timer.elapsed).totalseconds
write-host "Found $($hits) alert events in $($duration) seconds."
"-"*60
" "
if ($ShowEvents){$log_hits | fl | Out-String}
}
#save the history file to disk for next script run
$loghist | export-clixml $hist_file
#Send email if there were any monitored events found
if ($events_found -and -not $NoEmail){send_email}
}
#END OF RUN PASS
Write-Host "`n$("*"*60)"
Write-Host "Log monitor started at $(get-date)"
Write-Host "$("*"*60)`n"
#run the first pass
$start_pass = Get-Date
&$run_pass
#if $run_interval is set, calculate how long to sleep before the next pass
while ($run_interval -gt 0){
$last_run = (Get-Date) - $start_pass
$sleep_time = ([TimeSpan]::FromMinutes($run_interval) - $last_run).totalseconds
Write-Host "`n$("*"*10) Sleeping for $($sleep_time) seconds `n"
#sleep, and then start the next pass
Start-Sleep -seconds $sleep_time
$start_pass = Get-Date
&$run_pass
}
