Click here to monitor SSC
SQLServerCentral is supported by Redgate
 
Log in  ::  Register  ::  Not logged in
 
 
 


How to centralize your SQL Server Event Logs.


How to centralize your SQL Server Event Logs.

Author
Message
phildale
phildale
Forum Newbie
Forum Newbie (4 reputation)Forum Newbie (4 reputation)Forum Newbie (4 reputation)Forum Newbie (4 reputation)Forum Newbie (4 reputation)Forum Newbie (4 reputation)Forum Newbie (4 reputation)Forum Newbie (4 reputation)

Group: General Forum Members
Points: 4 Visits: 110
Geoff A (5/30/2012)
Hi Phil,

Only MSSQL logs will be forwarded to the central server. That is a SQL Server Agent function.
SQL Server Agent will not forward non SQL Application log entries.

The modification to the script will work, but only on the server where the error occurs.

Thanks


Thanks for the quick reply Geoff.

I'm having a little trouble trying to grasp the concept. Maybe I'm misunderstanding SQL Server Agent's role in this.

I only want to monitor one SQL Server, and write the errors into a database on that server. In this case, all errors are occurring on that one server, the server that is monitoring for errors. But the script isn't picking up non-SQL specific errors. If the script is reading directly from wherever the Event Viewer Application log is, it shouldn't matter that the errors are not SQL specific?

Thanks

Phil
Geoff A
Geoff A
SSChasing Mays
SSChasing Mays (606 reputation)SSChasing Mays (606 reputation)SSChasing Mays (606 reputation)SSChasing Mays (606 reputation)SSChasing Mays (606 reputation)SSChasing Mays (606 reputation)SSChasing Mays (606 reputation)SSChasing Mays (606 reputation)

Group: General Forum Members
Points: 606 Visits: 1790
try this script instead;

query = "Select * from __InstanceCreationEvent" _
& " " & "where TargetInstance isa 'Win32_NTLogEvent'" _
& " " & "and (TargetInstance.Logfile = 'Application' or TargetInstance.Logfile = 'System')" _
& " " & "and (TargetInstance.EventType = 1 or TargetInstance.EventType = 2)"
phildale
phildale
Forum Newbie
Forum Newbie (4 reputation)Forum Newbie (4 reputation)Forum Newbie (4 reputation)Forum Newbie (4 reputation)Forum Newbie (4 reputation)Forum Newbie (4 reputation)Forum Newbie (4 reputation)Forum Newbie (4 reputation)

Group: General Forum Members
Points: 4 Visits: 110
Geoff A (5/30/2012)
try this script instead;

query = "Select * from __InstanceCreationEvent" _
& " " & "where TargetInstance isa 'Win32_NTLogEvent'" _
& " " & "and (TargetInstance.Logfile = 'Application' or TargetInstance.Logfile = 'System')" _
& " " & "and (TargetInstance.EventType = 1 or TargetInstance.EventType = 2)"


Thanks for that, I've given it a try but I'm having the same results.

I thought the package might have cached the script or something so I recreated it with the correct script from the beginning, and it's still ignoring non-SQL errors.

Really confusing one.
adjas
adjas
SSC Rookie
SSC Rookie (42 reputation)SSC Rookie (42 reputation)SSC Rookie (42 reputation)SSC Rookie (42 reputation)SSC Rookie (42 reputation)SSC Rookie (42 reputation)SSC Rookie (42 reputation)SSC Rookie (42 reputation)

Group: General Forum Members
Points: 42 Visits: 104
Hi,

I am testing the script on one server and it works.
However it inserts four records for the same event.
Any thoughts?

Adam
chanjcc
chanjcc
Forum Newbie
Forum Newbie (3 reputation)Forum Newbie (3 reputation)Forum Newbie (3 reputation)Forum Newbie (3 reputation)Forum Newbie (3 reputation)Forum Newbie (3 reputation)Forum Newbie (3 reputation)Forum Newbie (3 reputation)

Group: General Forum Members
Points: 3 Visits: 74
c:\>cscript EventLog2DB.vbs
Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation. All rights reserved.

Step 0:
Msg 3201, Level 16, State 1, Line 1
Cannot open backup device 'f:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Backup\11'. Operating system error 3(The system cannot find the path specified.).
Msg 3013, Level 16, State 1, Line 1
BACKUP DATABASE is terminating abnormally.

Error in Step 0 triggers the following error. Please help
c:\EventLog2DB.vbs(30, 2) Microsoft OLE DB Provider for SQL Server: Conversion failed when converting the varchar value 'kF' to data type tinyint.
lsatchell
lsatchell
Forum Newbie
Forum Newbie (1 reputation)Forum Newbie (1 reputation)Forum Newbie (1 reputation)Forum Newbie (1 reputation)Forum Newbie (1 reputation)Forum Newbie (1 reputation)Forum Newbie (1 reputation)Forum Newbie (1 reputation)

Group: General Forum Members
Points: 1 Visits: 4
This article was the subjectline feature article 2nd May 2014 SQLServerCentral e-mail newsletter.

Come on guys, a circa 2010 solution featuring a VBscript!? Where's the powershell updated equivalent? VBscript should be relegated to Office macros by now....

Regards, Leigh.
Dan Guzman-481633
Dan Guzman-481633
SSC Journeyman
SSC Journeyman (84 reputation)SSC Journeyman (84 reputation)SSC Journeyman (84 reputation)SSC Journeyman (84 reputation)SSC Journeyman (84 reputation)SSC Journeyman (84 reputation)SSC Journeyman (84 reputation)SSC Journeyman (84 reputation)

Group: General Forum Members
Points: 84 Visits: 386
Any thoughts to using PowerShell instead of VBScript?
buddy__a
buddy__a
Old Hand
Old Hand (330 reputation)Old Hand (330 reputation)Old Hand (330 reputation)Old Hand (330 reputation)Old Hand (330 reputation)Old Hand (330 reputation)Old Hand (330 reputation)Old Hand (330 reputation)

Group: General Forum Members
Points: 330 Visits: 257
Any thoughts on using Powershell instead of VB?

Edit:

Apparently DanGuzman and I both had the same thought while not reading the entire thread.



Jeff Moden
Jeff Moden
SSC-Forever
SSC-Forever (45K reputation)SSC-Forever (45K reputation)SSC-Forever (45K reputation)SSC-Forever (45K reputation)SSC-Forever (45K reputation)SSC-Forever (45K reputation)SSC-Forever (45K reputation)SSC-Forever (45K reputation)

Group: General Forum Members
Points: 45038 Visits: 39893
lsatchell (5/1/2014)
This article was the subjectline feature article 2nd May 2014 SQLServerCentral e-mail newsletter.

Come on guys, a circa 2010 solution featuring a VBscript!? Where's the powershell updated equivalent? VBscript should be relegated to Office macros by now....

Regards, Leigh.


Dan Guzman-481633 (5/2/2014)
Any thoughts to using PowerShell instead of VBScript?


buddy__a (5/2/2014)
Any thoughts on using Powershell instead of VB?

Edit:

Apparently DanGuzman and I both had the same thought while not reading the entire thread.


Why? It still works even after more than 3 years. :-) Would PoSH make it better in some way? If so, I'm all for it. If not, I wouldn't change it.

--Jeff Moden

RBAR is pronounced ree-bar and is a Modenism for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
Stop thinking about what you want to do to a row... think, instead, of what you want to do to a column.
Although they tell us that they want it real bad, our primary goal is to ensure that we dont actually give it to them that way.
Although change is inevitable, change for the better is not.
Just because you can do something in PowerShell, doesnt mean you should. Wink

Helpful Links:
How to post code problems
How to post performance problems
Forum FAQs
buddy__a
buddy__a
Old Hand
Old Hand (330 reputation)Old Hand (330 reputation)Old Hand (330 reputation)Old Hand (330 reputation)Old Hand (330 reputation)Old Hand (330 reputation)Old Hand (330 reputation)Old Hand (330 reputation)

Group: General Forum Members
Points: 330 Visits: 257
Jeff Moden (5/2/2014)
lsatchell (5/1/2014)
This article was the subjectline feature article 2nd May 2014 SQLServerCentral e-mail newsletter.

Come on guys, a circa 2010 solution featuring a VBscript!? Where's the powershell updated equivalent? VBscript should be relegated to Office macros by now....

Regards, Leigh.


Dan Guzman-481633 (5/2/2014)
Any thoughts to using PowerShell instead of VBScript?


buddy__a (5/2/2014)
Any thoughts on using Powershell instead of VB?

Edit:

Apparently DanGuzman and I both had the same thought while not reading the entire thread.


Why? It still works even after more than 3 years. :-) Would PoSH make it better in some way? If so, I'm all for it. If not, I wouldn't change it.



Great point, I'm going to tell the company I'm working for to stop upgrading all those working VB6 apps. I'm not sure why Geoff bothered to use VBScript in the first place when he could have done this all in an assembly language app.

Or you could replace stuff like this:


Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
' get the events we want
query = "Select * from __InstanceCreationEvent" _
& " " & "where TargetInstance isa 'Win32_NTLogEvent'" _
& " " & "and TargetInstance.Logfile = 'Application'" _
& " " & "and (TargetInstance.EventType = 1 or TargetInstance.EventType = 2)" _
& " " & "and (TargetInstance.SourceName like 'MSSQL%')"
' get ready to insert into our DBA table
Set colMonitoredEvents = objWMIService.ExecNotificationQuery(query)



with this:


Get-EventLog -LogName Application -Source "MSSQL*" -EntryType Warning,Error



I don't get technology workers that say stuff like this. Working with the bottom code is much easier (and that's the whole purpose of technology) than all the string concatenated stuff above. Also, everyone new to the administration game (be it server admin or database admin) is learning Powershell, not VBScript. VBScript is dead, the new king is Powershell and it is so much better than VBScript. Geoff did a great job but there is nothing wrong with upgrading to new technology.



Go


Permissions

You can't post new topics.
You can't post topic replies.
You can't post new polls.
You can't post replies to polls.
You can't edit your own topics.
You can't delete your own topics.
You can't edit other topics.
You can't delete other topics.
You can't edit your own posts.
You can't edit other posts.
You can't delete your own posts.
You can't delete other posts.
You can't post events.
You can't edit your own events.
You can't edit other events.
You can't delete your own events.
You can't delete other events.
You can't send private messages.
You can't send emails.
You can read topics.
You can't vote in polls.
You can't upload attachments.
You can download attachments.
You can't post HTML code.
You can't edit HTML code.
You can't post IFCode.
You can't post JavaScript.
You can post emoticons.
You can't post or upload images.

Select a forum

































































































































































SQLServerCentral


Search