System & Application Log - Error & Warning - 3 Servers

[TRC_System_Admi]

Hello,

Is it possible to create a report for System logs (Errors & Warnings) for just 3 Servers? I have an asset group for these servers called Production.

Report Result would have the below columns

Event Date | Log | ServerName | Error Type | Event ID | Log Message
1/1/2017 | System | Server 1 | Error | 36888 | The following fatal alert was generated: 40
12/21/2016 | Application | Server 2 | Warning | 208 | SQL Server Scheduled Job 'ProductionDBs.Subplan

Icons would be fine for Error Types..

Also I would like to filter out 3 Event ID's 1111, 1112, & 1113

I would also like it to only list 14 Days of logs.

I would like this as a report and not the Event Filter Widget.

I would like the report flat with no grouping... if possible

Thank you.

[TRC_System_Admi · Accepted solution]

I figured it out. First I made an asset group (Configuration > Asset Groups > Static Asset Groups) called Production and added the servers I needed.

I set the system to scan for Warning events (Configuration > Server Options > Event Log Scanning > Scan Warning Events)

Select Top 1000000 tblNtlog.TimeGenerated,
tblAssets.AssetID,
Case tblNtlog.LogfileID When 1 Then 'Application' When 2 Then 'Log'
When 3 Then 'System' End As Log,
tblNtlog.Eventcode,
tblAssets.AssetName,
Case tblNtlog.Eventtype When 1 Then 'everrorsm.png'
When 2 Then 'evwarningsm.png' When 3 Then 'evinformationsm.png' End As icon,
Case tblNtlog.Eventtype When 1 Then 'Error' When 2 Then 'Warning'
When 3 Then 'Information' End As Type,
tblNtlogMessage.Message
From tblAssets
Inner Join tblAssetGroupLink On tblAssets.AssetID = tblAssetGroupLink.AssetID
Inner Join tblAssetGroups On tblAssetGroups.AssetGroupID =
tblAssetGroupLink.AssetGroupID
Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID
Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
tblNtlog.SourcenameID
Inner Join tblNtlogUser On tblNtlogUser.LoguserID = tblNtlog.LoguserID
Where tblNtlog.TimeGenerated > GetDate() - 7 And tblNtlog.Eventcode Not Like
'1111' And tblNtlog.Eventcode Not Like '1112' And tblAssetGroups.AssetGroup =
'Production'
Order By tblNtlog.TimeGenerated Desc