
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎09-20-2013 06:19 PM
Hi,
I'm trying to create a report that captures the "Critical" event type in EventViewer. I see Lansweeper captures all the other event types - error, warning, information, success audit, failure audit. Do you capture event type "Critical"?
Thanks
Nick
I'm trying to create a report that captures the "Critical" event type in EventViewer. I see Lansweeper captures all the other event types - error, warning, information, success audit, failure audit. Do you capture event type "Critical"?
Thanks
Nick
Labels:
- Labels:
-
Archive
4 REPLIES 4

Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎09-24-2013 05:28 PM
Thanks for the reply. I confirmed yesterday that the report is picking up "Critical" and "Error" from the event viewer.
Thanks
Thanks

Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎09-24-2013 05:16 PM
Just to confirm: the event type list we provided previously is incorrect. This is the event type list used by the Event Viewer itself, but Lansweeper pulls events from the Win32_NTLogEvent WMI class and this WMI class uses a different event type classification. These are the possible values for the tblNtlog.Eventtype field:
1 = Error
2 = Warning
3 = Information
4 = Security Audit Success
5 = Security Audit Failure
1 = Error
2 = Warning
3 = Information
4 = Security Audit Success
5 = Security Audit Failure

Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎09-23-2013 06:13 PM
Thanks for your help.
I'm using a similar report, and do grab eventtype 1. Which is picking up both "Critical" and "Error" types. Just didn't see that the first time around.
Thanks again!
I'm using a similar report, and do grab eventtype 1. Which is picking up both "Critical" and "Error" types. Just didn't see that the first time around.
Thanks again!

Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎09-23-2013 05:40 PM
LogAlways: 0, Critical: 1, Error: 2, Warning: 3, Information: 4, Verbose: 5
Select Top 1000000 Convert(nVARCHAR(10),tblNtlog.TimeGenerated,102) As Thedate,
tblAssets.AssetID As Total,
tblNtlogSource.Sourcename,
tblNtlog.Eventcode,
tblNtlog.Eventtype,
tblNtlog.LogfileID,
tblNtlogUser.Loguser,
tblNtlogMessage.Hash,
tblNtlogMessage.Message
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID
Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
tblNtlog.SourcenameID
Inner Join tblNtlogUser On tblNtlogUser.LoguserID = tblNtlog.LoguserID
Where tblNtlog.Eventtype = 1 And tblAssetCustom.State = 1 And
tblAssets.Assettype = -1
Order By Thedate Desc
Select Top 1000000 Convert(nVARCHAR(10),tblNtlog.TimeGenerated,102) As Thedate,
tblAssets.AssetID As Total,
tblNtlogSource.Sourcename,
tblNtlog.Eventcode,
tblNtlog.Eventtype,
tblNtlog.LogfileID,
tblNtlogUser.Loguser,
tblNtlogMessage.Hash,
tblNtlogMessage.Message
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID
Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
tblNtlog.SourcenameID
Inner Join tblNtlogUser On tblNtlogUser.LoguserID = tblNtlog.LoguserID
Where tblNtlog.Eventtype = 1 And tblAssetCustom.State = 1 And
tblAssets.Assettype = -1
Order By Thedate Desc
