질문글로 올라와서 팁앤테크에 정리해서 올려봅니다.^^
다음 vbscript 는 해당서버의 윈도우 이벤트로그를 계속 모니터링하고 있다가 이벤트로그 레코드가 새로 등록되면 체크하여 출력하는 스크립트 입니다.
물론 WMI 를 이용하고 있는데요,, WMI의 InstanceCreationEvent 이벤트를 이용하고 있습니다.
Option Explicit
Dim strComputer : strComputer = "." '로컬서버
Dim objWMI : set objWMI = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Dim colEvents : set colEvents = objWMI.ExecNotificationQuery( _
"Select * from __InstanceCreationEvent WHERE " & _
" TargetInstance ISA 'Win32_NTLogEvent'")
Do
Dim objEvent : set objEvent = colEvents.NextEvent
WScript.Echo "----------------------------"
WScript.Echo objEvent.TargetInstance.Logfile & " Event Log"
WScript.Echo "----------------------------"
WScript.Echo "Event ID: " & objEvent.TargetInstance.EventIdentifier
WScript.Echo "Source: " & objEvent.TargetInstance.SourceName
WScript.Echo "Category: " & objEvent.TargetInstance.CategoryString
WScript.Echo "Event Type: " & objEvent.TargetInstance.Type
Dim strText
for each strText in objEvent.TargetInstance.InsertionStrings
WScript.Echo "Event Text: " & strText
next
WScript.Echo "Computer: " & objEvent.TargetInstance.ComputerName
WScript.Echo "User: " & objEvent.TargetInstance.User
WScript.Echo "Time: " & objEvent.TargetInstance.TimeWritten
WScript.Echo
Loop
Dim strComputer : strComputer = "." '로컬서버
Dim objWMI : set objWMI = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Dim colEvents : set colEvents = objWMI.ExecNotificationQuery( _
"Select * from __InstanceCreationEvent WHERE " & _
" TargetInstance ISA 'Win32_NTLogEvent'")
Do
Dim objEvent : set objEvent = colEvents.NextEvent
WScript.Echo "----------------------------"
WScript.Echo objEvent.TargetInstance.Logfile & " Event Log"
WScript.Echo "----------------------------"
WScript.Echo "Event ID: " & objEvent.TargetInstance.EventIdentifier
WScript.Echo "Source: " & objEvent.TargetInstance.SourceName
WScript.Echo "Category: " & objEvent.TargetInstance.CategoryString
WScript.Echo "Event Type: " & objEvent.TargetInstance.Type
Dim strText
for each strText in objEvent.TargetInstance.InsertionStrings
WScript.Echo "Event Text: " & strText
next
WScript.Echo "Computer: " & objEvent.TargetInstance.ComputerName
WScript.Echo "User: " & objEvent.TargetInstance.User
WScript.Echo "Time: " & objEvent.TargetInstance.TimeWritten
WScript.Echo
Loop
서버를 지정하는 부분에서, 현재는 로컬서버 예제입니다.
만약 다른 서버를 체크하고자 한다면 절적한 권한이 있어야 합니다. DCOM 를 활성화하고 접근할수 있는 권한 및 WMI 쿼리권한도 있어야 하는데요. 일반적으로 Administrators 권한이면 되겠죠..
자 그럼 테스트 해볼까요?.. 샘플 결과입니다.
E:\>EventLogMonitor.vbs
Microsoft (R) Windows Script Host 버전 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
Microsoft (R) Windows Script Host 버전 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
----------------------------
Security Event Log
----------------------------
Event ID: 592
Source: Security
Category: 세부 추적
Event Type: 감사 성공
Event Text: 2976
Event Text: C:\WINDOWS\system32\mmc.exe
Event Text: 940
Event Text: Administrator
Event Text: SERVERINFO
Event Text: (0x0,0x10DCB)
Computer: SERVERINFO
User: SERVERINFO\Administrator
Time: 20061021150623.000000+540
위 스크립트의 출력형식대로 잘 보여줍니다.
자. 그럼 난 메일로 받아 보고 싶다 라면 vbscript 가 실행된는 서버어 IIS SMTP 가 설치되어 있거나 다른 SMTP 서버를 이용하면 됩니다. cdo를 이용한 메일발송 샘플인데요. 처음 코드중 다음과 같이 하면 되겠죠.
Do
Dim objEvent : set objEvent = colEvents.NextEvent
set msg = WScript.CreateObject("CDO.Message")
msg.From = webmaster@serverinfo.pe.kr
msg.To = webmaster@serverinfo.pe.kr
msg.Subject = objEvent.TargetInstance.Logfile & "이벤트로그"
msg.TextBody = " " & _
"Event ID: " & objEvent.TargetInstance.EventIdentifier & _
"Source: " & objEvent.TargetInstance.SourceName & _
"Category: " & objEvent.TargetInstance.CategoryString & _
"Event Type: " & objEvent.TargetInstance.Type
msg.Send
Set msg = Nothing
Loop
Dim objEvent : set objEvent = colEvents.NextEvent
set msg = WScript.CreateObject("CDO.Message")
msg.From = webmaster@serverinfo.pe.kr
msg.To = webmaster@serverinfo.pe.kr
msg.Subject = objEvent.TargetInstance.Logfile & "이벤트로그"
msg.TextBody = " " & _
"Event ID: " & objEvent.TargetInstance.EventIdentifier & _
"Source: " & objEvent.TargetInstance.SourceName & _
"Category: " & objEvent.TargetInstance.CategoryString & _
"Event Type: " & objEvent.TargetInstance.Type
msg.Send
Set msg = Nothing
Loop
처럼 코드를 약간 변경해 주시면 됩니다.
