Event Summary Report for specific server

[daigls]

Hi,

is it possible to get a server specific event summary report, like "event summary servers" under DASHBOARD\SERVERS
THX

[Susan_A]

It's not clear to us whether you are still trying to count events or simply list them. To list all of the events that occurred on a specific machine in the last 7 days, use the report below. If you are interested in building or modifying reports, we would recommend:

• Reviewing some SQL tutorials, as the Lansweeper report builder uses standard SQL queries. This seems like a good tutorial.
  
• Updating to Lansweeper 5.2, if you haven't already. Lansweeper 5.2 includes a database dictionary, which is linked at the top of the report builder.

Select Top 1000000 tsysOS.Image As icon,
  tblAssets.AssetID,
  tblAssets.AssetName,
  tblAssets.Domain,
  tblAssets.IPAddress,
  tblAssets.Firstseen,
  tblAssets.Lastseen,
  tblAssets.Lasttried,
  tblNtlog.Eventcode,
  tblNtlog.TimeGenerated,
  Case tblNtlog.Eventtype When 1 Then 'error' When 2 Then 'warning'
    When 3 Then 'information' When 4 Then 'success audit'
    When 5 Then 'failure audit' End As Eventtype,
  tblNtlogFile.Logfile,
  tblNtlogSource.Sourcename,
  tblNtlogMessage.Message,
  tblNtlogUser.Loguser
From tblAssets
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tsysOS On tsysOS.OScode = tblAssets.OScode
  Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID
  Inner Join tblNtlogFile On tblNtlogFile.LogfileID = tblNtlog.LogfileID
  Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
  Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
    tblNtlog.SourcenameID
  Inner Join tblNtlogUser On tblNtlogUser.LoguserID = tblNtlog.LoguserID
Where tblAssets.AssetName = 'YourServer' And tblNtlog.TimeGenerated > GetDate() - 7
  And tblAssetCustom.State = 1
Order By tblNtlog.TimeGenerated Desc

[daigls]

Hi,

thank you very much.

Now i can see the EventCount from the specific server , but no details like event message or eventcode.

Is it possible to show this in the report?

THX

[Susan_A · Accepted solution]

Please use the report below for the information you are after and replace YourServer with the name of the server and 7 (days) with the time frame you would like to report on. Instructions for running reports can be found here.

Select Top 1000000 tblNtlogSource.Sourcename As EventSource,
  tblAssets.AssetID,
  Count(tblNtlog.EventlogID) As EventCount
From tblAssets
  Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID
  Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
    tblNtlog.SourcenameID
Where tblAssets.AssetName = 'YourServer' And tblNtlog.TimeGenerated >
  GetDate() - 7
Group By tblNtlogSource.Sourcename,
  tblAssets.AssetID
Order By EventCount Desc