How to centralize your SQL Server Event Logs.

  • phildale

    SSC Journeyman

    Points: 86

    Geoff A (5/30/2012)


    Hi Phil,

    Only MSSQL logs will be forwarded to the central server. That is a SQL Server Agent function.

    SQL Server Agent will not forward non SQL Application log entries.

    The modification to the script will work, but only on the server where the error occurs.

    Thanks

    Thanks for the quick reply Geoff.

    I'm having a little trouble trying to grasp the concept. Maybe I'm misunderstanding SQL Server Agent's role in this.

    I only want to monitor one SQL Server, and write the errors into a database on that server. In this case, all errors are occurring on that one server, the server that is monitoring for errors. But the script isn't picking up non-SQL specific errors. If the script is reading directly from wherever the Event Viewer Application log is, it shouldn't matter that the errors are not SQL specific?

    Thanks

    Phil

  • Geoff A

    SSChampion

    Points: 11417

    try this script instead;

    query = "Select * from __InstanceCreationEvent" _

    & " " & "where TargetInstance isa 'Win32_NTLogEvent'" _

    & " " & "and (TargetInstance.Logfile = 'Application' or TargetInstance.Logfile = 'System')" _

    & " " & "and (TargetInstance.EventType = 1 or TargetInstance.EventType = 2)"

  • phildale

    SSC Journeyman

    Points: 86

    Geoff A (5/30/2012)


    try this script instead;

    query = "Select * from __InstanceCreationEvent" _

    & " " & "where TargetInstance isa 'Win32_NTLogEvent'" _

    & " " & "and (TargetInstance.Logfile = 'Application' or TargetInstance.Logfile = 'System')" _

    & " " & "and (TargetInstance.EventType = 1 or TargetInstance.EventType = 2)"

    Thanks for that, I've given it a try but I'm having the same results.

    I thought the package might have cached the script or something so I recreated it with the correct script from the beginning, and it's still ignoring non-SQL errors.

    Really confusing one.

  • adjas

    SSC Enthusiast

    Points: 136

    Hi,

    I am testing the script on one server and it works.

    However it inserts four records for the same event.

    Any thoughts?

    Adam

  • chanjcc

    Valued Member

    Points: 67

    c:\>cscript EventLog2DB.vbs

    Microsoft (R) Windows Script Host Version 5.8

    Copyright (C) Microsoft Corporation. All rights reserved.

    Step 0:

    Msg 3201, Level 16, State 1, Line 1

    Cannot open backup device 'f:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Backup\11'. Operating system error 3(The system cannot find the path specified.).

    Msg 3013, Level 16, State 1, Line 1

    BACKUP DATABASE is terminating abnormally.

    Error in Step 0 triggers the following error. Please help

    c:\EventLog2DB.vbs(30, 2) Microsoft OLE DB Provider for SQL Server: Conversion failed when converting the varchar value 'kF' to data type tinyint.

  • lsatchell

    Grasshopper

    Points: 13

    This article was the subjectline feature article 2nd May 2014 SQLServerCentral e-mail newsletter.

    Come on guys, a circa 2010 solution featuring a VBscript!? Where's the powershell updated equivalent? VBscript should be relegated to Office macros by now....

    Regards, Leigh.

  • Dan Guzman

    Default port

    Points: 1480

    Any thoughts to using PowerShell instead of VBScript?

  • buddy__a

    Hall of Fame

    Points: 3222

    Any thoughts on using Powershell instead of VB?

    Edit:

    Apparently DanGuzman and I both had the same thought while not reading the entire thread.

  • Jeff Moden

    SSC Guru

    Points: 996502

    lsatchell (5/1/2014)


    This article was the subjectline feature article 2nd May 2014 SQLServerCentral e-mail newsletter.

    Come on guys, a circa 2010 solution featuring a VBscript!? Where's the powershell updated equivalent? VBscript should be relegated to Office macros by now....

    Regards, Leigh.

    Dan Guzman-481633 (5/2/2014)


    Any thoughts to using PowerShell instead of VBScript?

    buddy__a (5/2/2014)


    Any thoughts on using Powershell instead of VB?

    Edit:

    Apparently DanGuzman and I both had the same thought while not reading the entire thread.

    Why? It still works even after more than 3 years. 🙂 Would PoSH make it better in some way? If so, I'm all for it. If not, I wouldn't change it.

    --Jeff Moden


    RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
    First step towards the paradigm shift of writing Set Based code:
    ________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.
    "Change is inevitable... change for the better is not".

    Helpful Links:
    How to post code problems
    How to Post Performance Problems
    Create a Tally Function (fnTally)
    Forum FAQ

  • buddy__a

    Hall of Fame

    Points: 3222

    Jeff Moden (5/2/2014)


    lsatchell (5/1/2014)


    This article was the subjectline feature article 2nd May 2014 SQLServerCentral e-mail newsletter.

    Come on guys, a circa 2010 solution featuring a VBscript!? Where's the powershell updated equivalent? VBscript should be relegated to Office macros by now....

    Regards, Leigh.

    Dan Guzman-481633 (5/2/2014)


    Any thoughts to using PowerShell instead of VBScript?

    buddy__a (5/2/2014)


    Any thoughts on using Powershell instead of VB?

    Edit:

    Apparently DanGuzman and I both had the same thought while not reading the entire thread.

    Why? It still works even after more than 3 years. 🙂 Would PoSH make it better in some way? If so, I'm all for it. If not, I wouldn't change it.

    Great point, I'm going to tell the company I'm working for to stop upgrading all those working VB6 apps. I'm not sure why Geoff bothered to use VBScript in the first place when he could have done this all in an assembly language app.

    Or you could replace stuff like this:

    Set objWMIService = GetObject("winmgmts:" _

    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

    ' get the events we want

    query = "Select * from __InstanceCreationEvent" _

    & " " & "where TargetInstance isa 'Win32_NTLogEvent'" _

    & " " & "and TargetInstance.Logfile = 'Application'" _

    & " " & "and (TargetInstance.EventType = 1 or TargetInstance.EventType = 2)" _

    & " " & "and (TargetInstance.SourceName like 'MSSQL%')"

    ' get ready to insert into our DBA table

    Set colMonitoredEvents = objWMIService.ExecNotificationQuery(query)

    with this:

    Get-EventLog -LogName Application -Source "MSSQL*" -EntryType Warning,Error

    I don't get technology workers that say stuff like this. Working with the bottom code is much easier (and that's the whole purpose of technology) than all the string concatenated stuff above. Also, everyone new to the administration game (be it server admin or database admin) is learning Powershell, not VBScript. VBScript is dead, the new king is Powershell and it is so much better than VBScript. Geoff did a great job but there is nothing wrong with upgrading to new technology.

  • jswong05

    Hall of Fame

    Points: 3503

    1) You can see how I used Powershell to accomplish this kind of things from one centralized server pulling at SQLSaturday#308.

    2) If the VBScript agent has to be delivered to each every host, that is a drag. No, no.

    Jason
    http://dbace.us
    😛

  • quackhandle1975

    SSChampion

    Points: 10963

    Great article, thanks.

    qh

    [font="Tahoma"]Who looks outside, dreams; who looks inside, awakes. – Carl Jung.[/font]
  • Santhoshkumar KB

    SSCertifiable

    Points: 5066

    The setup is complete.

    When I test with the following statement, 8 SAME records are inserted.

    raiserror ('working great',16,1) with log

    Everytime I run, 8 records are being inserted. Is it normal or am I missing something?

    Thanks,
    Santhosh


    Human Knowledge Belongs To The World !!

Viewing 13 posts - 61 through 73 (of 73 total)

You must be logged in to reply to this topic. Login to reply