我试图编辑下面的脚本,以利用任务调度程序,每次在我们的服务器事件查看器中记录错误/警告/失败时,都会发送电子邮件通知。
重要信息:
H 210F 211提前感谢您的帮助。下面是来自https://github.com/blachniet/blachniet-psutils/blob/master/Send-EventEntryEmail.psm1的脚本:
Import-Module $PSScriptRoot\Send-EventEntryEmail.psm1
Function Send-EventEntryEmail {
[CmdletBinding()]
param(
[Parameter()]
[string] $LogName = "System""Application""Security,
[Parameter(Mandatory=$true)]
[string] $Source,
[Parameter()]
[int] $Newest = 5,
[Parameter()]
[string[]] $EntryType = "Error""Warning""Failure",
[Parameter(Mandatory=$true)]
[string] $SmtpUser = "helpdesk@mydomain.com",
[Parameter(Mandatory=$true)]
[string] $SmtpPassword = "passwordexample",
[Parameter()]
[int] $SmtpPort = 587,
[Parameter()]
[string] $SmtpServer = "smtp.mail.outlook.com",
[Parameter(Mandatory=$true)]
[string] $MailFrom = "helpdesk@mydomain.com",
[Parameter(Mandatory=$true)]
[string] $MailTo = "myemail@mydomain.com,
[Parameter()]
[string] $Subject = "EventLogAlert",
)
# Get the event entries.
$eventEntries = Get-EventLog -LogName $LogName -Source $Source -Newest $Newest -EntryType $EntryType
# Create a table row for each entry.
$rows = ""
foreach ($eventEntry in $eventEntries){
$rows += @"
<tr>
<td style="text-align: center; padding: 5px;">$($eventEntry.TimeGenerated)</td>
<td style="text-align: center; padding: 5px;">$($eventEntry.EntryType)</td>
<td style="padding: 5px;">$($eventEntry.Message)</td>
</tr>
"@
}
# Create the email.
$email = New-Object System.Net.Mail.MailMessage( $MailFrom , $MailTo )
$email.Subject = $Subject
$email.IsBodyHtml = $true
$email.Body = @"
<table style="width:100%;border">
<tr>
<th style="text-align: center; padding: 5px;">Time</th>
<th style="text-align: center; padding: 5px;">Type</th>
<th style="text-align: center; padding: 5px;">Message</th>
</tr>
$rows
</table>
"@
# Send the email.
$SMTPClient=New-Object System.Net.Mail.SmtpClient( $SmtpServer , $SmtpPort )
$SMTPClient.EnableSsl=$true
$SMTPClient.Credentials=New-Object System.Net.NetworkCredential( $SmtpUser , $SmtpPassword );
$SMTPClient.Send( $email )
}
Export-ModuleMember Send-EventEntryEmail下面是运行当前脚本时在ISE中遇到的错误:
At line:17 char:34
+ [string[]] $EntryType = "Error""Warning""Failure",
+ ~
Missing ')' in function parameter list.
At line:35 char:49
+ [string] $MailTo = "myemail@mydomain.com,
+ ~
Missing argument in parameter list.
At line:37 char:20
+ [Parameter()]
+ ~
An expression was expected after '('.
At line:38 char:45
+ [string] $Subject = "EventLogAlert",
+ ~
Missing expression after ','.
At line:3 char:31
+ Function Send-EventEntryEmail {
+ ~
Missing closing '}' in statement block or type definition.
At line:40 char:5
+ )
+ ~
Unexpected token ')' in expression or statement.
At line:78 char:1
+ }
+ ~
Unexpected token '}' in expression or statement.
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : MissingEndParenthesisInFunctionParameterList发布于 2021-01-15 18:26:29
您可以通过电子邮件订阅事件日志,方法是设置一个预定任务,该任务将接收新事件的通知并通过电子邮件传递。
在“任务计划程序”中,首先添加由"On“触发的任务。若要订阅特定的日志/源/事件ID组合,请使用"Basic“。若要订阅许多事件,请使用“自定义”和满足您需要的事件筛选器。

无论哪种方式,第二步都是一个powershell脚本,它可以检查事件并通过电子邮件转发它。这可以通过在Task中添加一个操作来完成,它调用powershell.exe并传递.\MyDelightfulScriptName.ps1 -eventRecordID $(eventRecordID) -eventChannel $(eventChannel)。

然后按照bergerb的指示将事件记录ID和通道传递到powershell。
要访问记录的事件,powershell脚本使用Get-WinEvent和EventRecordID过滤器:
# Collects all named paramters (all others end up in $Args)
param($eventRecordID,$eventChannel)
$event = Get-WinEvent -LogName $eventChannel -FilterXPath "<QueryList><Query Id='0' Path='$eventChannel'><Select Path='$eventChannel'>*[System[(EventRecordID=$eventRecordID)]]</Select></Query></QueryList>";
Send-MailMessage `
-From 'evetlog@server.domain.local' `
-To 'admin@domain.local' `
-Subject ($event.Message.Split([Environment]::NewLine)[0]) `
-SmtpServer 'smtp.domain.local' `
-Body ($event.Message);https://stackoverflow.com/questions/65726315
复制相似问题