Mr. Roboto

Event by Event

Strapped for cash? Forget expensive server management tools -- here's a real-time event log monitor for the smaller shops.

• By Jeffery Hicks
• 10/01/2007

If you're from a smaller, more financially constrained shop, Mr. Roboto has crafted a real-time event log monitor for you. Well, it's close to real time. Specify a server or two and the types of events you want to monitor and Mr. Roboto's Event Log Monitor will display events pretty much as they happen.

Admins Only
Mr. Roboto's Event Log Monitor is an HTML application (HTA) that uses Windows Management Instrumentation (WMI) to watch for new event log entries on remote servers. Although you can install this on a server, it makes more sense to use it from your desktop.

As with most of my utilities, this HTA requires Windows XP or later. You'll have to run this tool with administrator credentials on the systems you want to manage.

This utility will run under Windows Vista, but you'll need to run it as an administrator. The HTA file type isn't recognized as an executable, so you can't run it by choosing the "Run as Administrator" option. Here's a workaround for that limitation:

Create a new shortcut and set the target path to: C:\Windows\System32\mshta.exe c:\install-path-to\Eventlog monitor.hta

If you'd like, you can change the icon to point to the icon file in the same directory as the HTA. Just right-click on the shortcut, and select "Run as Administrator" to launch the tool. The Event Log Monitor will then start with the right level of access control.

After you've launched the tool, enter the name or names of computers you want to monitor, separated by commas. Select the event logs and types of events you want to monitor from the drop down boxes. Use the Ctrl key to select multiple entries. You can mix and match event logs, even if they aren't on the computer you're monitoring. This lets you monitor errors in the system log on a file server or domain controller. You can also monitor Directory Service errors.

The Event Log Monitor uses WMI to establish an asynchronous event query to each specified server. When an event fires on the remote machine, information about that event is returned to the Event Log Monitor.

By default, the HTA will check for new events every five seconds. You can increase this time interval, but I wouldn't recommend making it any shorter. When an event fires from any machine in your list, the tool will display event info, including the machine name. Errors and Audit Failures will show up in a red font.

If the network connection between the remote computer and the computer running the Event Log Monitor is interrupted (if the remote computer is rebooting, for example), it won't capture any more events until you restart the monitor and re-query. You shouldn't select more event types than you really need, especially when you're monitoring multiple servers.

Close to Real Time
Event Log Monitor is hard-coded with the most common Windows events. I wanted to give you the option of selecting multiple servers, so I compromised. If there's a log type that isn't listed, you can edit the HTML code and add it to the option control.

The Event Log Monitor doesn't permanently store any event information. Events are still written to the event log on each server. The monitor simply lets you know -- in close to real time -- when it has recorded an event.

If you can afford one of the full-featured event log consolidation and management tools, then by all means find one that meets your business needs. In the meantime, Mr. Roboto's Event Log Monitor will fill in the gaps and help you keep a close eye on critical or troublesome servers.