Event log report

[admin1]

I need a daily report of a group of server in a specific OU in AD. I want to use this to replace an old eventlog server that will be going out of support and I thought lansweeper could replace this.

[taschenit]

Thanks! deleting the tblComputersystem.Domainrole argument did the trick. However, now, the report only shows eventlog errors but no warning or informational events. How can I get those, too?

[Hemoco]

taschenit wrote:
Thanks! deleting the tblComputersystem.Domainrole argument did the trick. However, now, the report only shows eventlog errors but no warning or informational events. How can I get those, too?

Lansweeper only scans errors by default. Additional event types can be enabled in the Configuration/Scanning Setup/Server Options section of the Lansweeper web console.

Note that scanning non-error events can quickly increase the size of your database. We recommend lowering the "delete eventlog entries after XX days" setting as much as possible under Configuration/Scanning Setup/Server Options.

[taschenit]

Hi,

this report would be useful to us, too. But it returns 0 results. Where should I start looking for Errors? OU DN is correct. We are running LANSweeper 5.0.

Thanks in advance.
Tim

[Hemoco]

taschenit wrote:
this report would be useful to us, too. But it returns 0 results. Where should I start looking for Errors? OU DN is correct. We are running LANSweeper 5.0.

The report we provided only lists events that meet all of the following requirements:
- The event occurred within the last day.
- The event occurred on a computer whose state is set to "active".
- The event occurred on a server.
- The event occurred within the specified OU.

If there's no results for the report, there are no events in your database that meet all of these requirements.

[admin1]

Perfect thanks guys

[Hemoco · Accepted solution]

A sample event log report can be seen below. It lists events that occurred in the last day. Replace what we’ve marked in bold, making sure there’s no spaces in the OU name.

Select Top 1000000 tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tsysAssetTypes.AssetTypeIcon10 As icon,
tblAssets.IPAddress,
tblAssets.Lastseen,
tblNtlog.Eventcode,
Case tblNtlog.Eventtype When 1 Then 'Error' When 2 Then 'Warning'
When 3 Then 'Information' When 4 Then 'Success Audit'
When 5 Then 'Failure Audit' End As Eventtype,
tblNtlogFile.Logfile,
tblNtlogSource.Sourcename,
tblNtlogMessage.Message,
tblNtlogUser.Loguser,
tblNtlog.TimeGenerated
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID
Inner Join tblNtlogFile On tblNtlogFile.LogfileID = tblNtlog.LogfileID
Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
tblNtlog.SourcenameID
Inner Join tblNtlogUser On tblNtlogUser.LoguserID = tblNtlog.LoguserID
Inner Join tblComputersystem On tblAssets.AssetID = tblComputersystem.AssetID
Inner Join tblADComputers On tblAssets.AssetID = tblADComputers.AssetID
Where tblNtlog.TimeGenerated > GetDate() - 1 And tblAssetCustom.State = 1 And
tblComputersystem.Domainrole > 1 And
tblADComputers.OU = 'OU=Servers,DC=lansweeper,DC=local'
Order By tblNtlog.TimeGenerated Desc