Richard Burt (AIPSO) asked a question.

June 16, 2025 at 3:24 PM
Event ID monitoring

HI -

 

I have a PowerShell script to monitor 3 event ids and send an alert if its true it doesn't work when I add it to wug but works locally on the server.

 

$LogName = "Application"

$EventIDs = @(431, 403)

$MaxEventsToCheck = 20

$MatchingEvents = @()

 

foreach ($id in $EventIDs) {

  $events = Get-WinEvent -FilterHashtable @{LogName=$LogName; ID=$id} -MaxEvents $MaxEventsToCheck -ErrorAction SilentlyContinue

  $MatchingEvents += $events

}

 

if ($MatchingEvents.Count -gt 0) {

  $ids = ($MatchingEvents | Select-Object -ExpandProperty Id -Unique) -join ", "

  $Context.SetResult(1, "Found matching Event ID(s): $ids")

} else {

  $Context.SetResult(0, "No matching Event IDs found.")

}

  • 1 answer
  • 115 views
Nichol Goldstein and Richard Burt like this.

  • Mike Rockwell (Progress Software)

    I fixed it for you to work getting the Event Log from a remote machine in WUG.

    1. $LogName = "Application"
    2. $EventIDs = @(431, 403)
    3. $MaxEventsToCheck = 20
    4. $MatchingEvents = @()
    5.  
    6. #Get Device Name for Remote computer
    7. $ip = $Context.GetProperty("Address");
    8. $DnsEntry = [System.Net.DNS]::GetHostByAddress($ip);
    9. $Device = [string]$DnsEntry.HostName;
    10.  
    11. #Look for the event IDs
    12. foreach ($id in $EventIDs) {
    13. $events = Get-WinEvent -FilterHashtable @{LogName = $LogName; ID = $id } -ComputerName $Device -MaxEvents $MaxEventsToCheck -ErrorAction SilentlyContinue
    14. $MatchingEvents += $events
    15. }
    16.  
    17. if ($MatchingEvents.Count -gt 0) {
    18. $ids = ($MatchingEvents | Select-Object -ExpandProperty Id -Unique) -join ", "
    19. $Context.SetResult(1, "Found matching Event ID(s): $ids")
    20. }
    21. else {
    22. $Context.SetResult(0, "No matching Event IDs found.")
    23. }

     Create a PowerShell Active Monitor, copy-paste the code above in to the script block. Save it, apply to devices.