Hi all, I am using event viewer with script to make actions on certain events. How can i know what event is still "hapenning" lets say i have event id 2048 which talking about Hardisk physical failure that was removed from a RAID5. Right now, when i will reboot the computer it still popup the event ID after the boot. but i want to make a "system scan" that will scan the events not on each boot, but every 24/48 hours. This will be like monitoring the events and as long they are not handled i want them to start a script. My mission is to make my sever handle errors, fan, hardisk, memory etc. and on each error, it will send email. i was using dell open manage to send email notification, but it wasnt good, cuz if i plug out raid5 hardisk when the server is offline, and it comes back, it wont send me alert. with event viewer it sends, but i want to make a schedule scans.. like every 2 days to make a system scan and see everything is ok. and if there are events on a list that occuring - to notify them. Thanks.

It is very difficult task. Adaptive/selflearning scripts with event and repair memories will do it. You do not know the internal structure of some errors and warnings. In the case of disk it may be an error in the eventing, because of the system did not reset the flag or it is correct, because the RAID recalculates for some time and the status is set to faulty until the recalculation is done. I do remember a case of unrecoverable eventing in the case of two domain controllers with the same DNS settings. When one DC starts, it issued error about missing second DC and the log was full of events about messages on pointing to the first error. It work properly, only the log was overcrowded by warnings.