UMnieDziala.pl

  Po zupdetowaniu serwery się niestety muszą zrestartować. I rzadko im to wychodzi dobrze. Dlatego zawsze warto wiedzieć kiedy serwer będzie wykonywał tą operację. W tym celu zakładamy trigera na event log systemowy , na zdarzenie 1074, za pomocą eventtrigger.exe - dostępnego kazdym systemie xp i 2k3- i podpinamy do ponizszego skryptu.

On Error Resume Next

addr = "LSD"
msgTo = "kfaz@pjwstk.edu.pl;pkrzysz@pjwstk.edu.pl"
textBody="Serwer " & addr &" wła¶nie wszedł w tryb restart/shutdown "& vbCRLF

Const wbemFlagReturnImmediately = &h10
Const wbemFlagForwardOnly = &h20
strComputer ="localhost"
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_NTLogEvent WHERE Logfile = 'System' And EventCode=1074 ", "WQL", _
wbemFlagReturnImmediately + wbemFlagForwardOnly)

For Each objItem In colItems
textBody=textBody& "Category: " & objItem.Category & vbCRLF
textBody=textBody& "CategoryString: " & objItem.CategoryString&vbCRLF
textBody=textBody& "ComputerName: " & objItem.ComputerName&vbCRLF
strData = Join(objItem.Data, ",")
textBody=textBody& "Data: " & strData& vbCRLF
textBody=textBody&"EventCode: " & objItem.EventCode& vbCRLF
textBody=textBody&"EventIdentifier: " & objItem.EventIdentifier& vbCRLF
textBody=textBody&"EventType: " & objItem.EventType& vbCRLF
strInsertionStrings = Join(objItem.InsertionStrings, ",")
textBody=textBody& "InsertionStrings: " & strInsertionStrings& vbCRLF
textBody=textBody& "Logfile: " & objItem.Logfile& vbCRLF
textBody=textBody& "Message: " & objItem.Message& vbCRLF
textBody=textBody& "RecordNumber: " & objItem.RecordNumber& vbCRLF
textBody=textBody& "SourceName: " & objItem.SourceName& vbCRLF
textBody=textBody& "TimeGenerated: " & WMIDateStringToDate(objItem.TimeGenerated)& vbCRLF
textBody=textBody& "TimeWritten: " & WMIDateStringToDate(objItem.TimeWritten)& vbCRLF
textBody=textBody& vbCRLF
textBody=textBody& vbCRLF
textBody=textBody&"by peki"& vbCRLF
Exit For
Next


oSendUsingPickup = 1 'Send message using the local SMTP service pickup directory.
Const cdoSendUsingPort = 2 'Send the message using the network (SMTP over the network).

Const cdoAnonymous = 0 'Do not authenticate
Const cdoBasic = 1 'basic (clear-text) authentication
Const cdoNTLM = 2 'NTLM

Set objMessage = CreateObject("CDO.Message")
objMessage.Subject = "Serwer " & addr & " shutdown/restart"
objMessage.From = """RRdTooL Server Watch"" <pkrzysz@pjwstk.edu.pl>"
objMessage.To = msgTo
objMessage.TextBody = textBody

'==This section provides the configuration information for the remote SMTP server.

objMessage.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2

'Name or IP of Remote SMTP Server
objMessage.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "dfs2"

'Type of authentication, NONE, Basic (Base64 encoded), NTLM
objMessage.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/smtpauthenticate") = cdoNTLM

'Server port (typically 25)
objMessage.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25

'Use SSL for the connection (False or True)
objMessage.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/smtpusessl") = False

'Connection Timeout in seconds (the maximum time CDO will try to establish a connection to the SMTP server)
objMessage.Configuration.Fields.Item _
("http://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout") = 60

objMessage.Configuration.Fields.Update

'==End remote SMTP server configuration section==

objMessage.Send


Function WMIDateStringToDate(dtmDate)
WScript.Echo dtm:
    WMIDateStringToDate = CDate(Mid(dtmDate, 5, 2) & "/" & _
    Mid(dtmDate, 7, 2) & "/" & Left(dtmDate, 4) _
    & " " & Mid (dtmDate, 9, 2) & ":" & Mid(dtmDate, 11, 2) & ":" & Mid(dtmDate,13, 2))
End Function

Skrypt ten wysyła emaila do administratora , ze maszyna przeszła w tryb restartu/shutdownu, oraz podaje odpowiedni wpis z dziennika zdarzeń. Jak mozna zauwazyc, w skrypcie sa pobierane wszystkie wartosci z logu system o id 1074, a nie tylko ostatnia - wynika to ze w WQL brakuję prostego słowa kluczowego TOP.