Critical errors in Event Viewer

[nhydukewich]

Hi,

I'm trying to create a report that captures the "Critical" event type in EventViewer. I see Lansweeper captures all the other event types - error, warning, information, success audit, failure audit. Do you capture event type "Critical"?

Thanks
Nick

[nhydukewich]

Thanks for the reply. I confirmed yesterday that the report is picking up "Critical" and "Error" from the event viewer.

Thanks

[Hemoco]

Just to confirm: the event type list we provided previously is incorrect. This is the event type list used by the Event Viewer itself, but Lansweeper pulls events from the Win32_NTLogEvent WMI class and this WMI class uses a different event type classification. These are the possible values for the tblNtlog.Eventtype field:

1 = Error
2 = Warning
3 = Information
4 = Security Audit Success
5 = Security Audit Failure

[nhydukewich]

Thanks for your help.

I'm using a similar report, and do grab eventtype 1. Which is picking up both "Critical" and "Error" types. Just didn't see that the first time around.

Thanks again!

[Hemoco]

LogAlways: 0, Critical: 1, Error: 2, Warning: 3, Information: 4, Verbose: 5


Select Top 1000000 Convert(nVARCHAR(10),tblNtlog.TimeGenerated,102) As Thedate,
tblAssets.AssetID As Total,
tblNtlogSource.Sourcename,
tblNtlog.Eventcode,
tblNtlog.Eventtype,
tblNtlog.LogfileID,
tblNtlogUser.Loguser,
tblNtlogMessage.Hash,
tblNtlogMessage.Message
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID
Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
tblNtlog.SourcenameID
Inner Join tblNtlogUser On tblNtlogUser.LoguserID = tblNtlog.LoguserID
Where tblNtlog.Eventtype = 1 And tblAssetCustom.State = 1 And
tblAssets.Assettype = -1
Order By Thedate Desc