Scheduling a task with event triggers slight problem
Hi. I am trying to schedule a task and trigger it when a certain kind of event happens in the event viewer. The only problem is there is no unique event ID since all the applications event ID's are 1. However there are two data sections one containing just "Connections" and another data tag which starts with "authenticated:" and that last one is how it starts, there is more which is unique each time with IP address information etc. Can I do a wildcard that will find an event that has its data starting with "authenticated" ? I cannot do this any other way. Here is an original event with the ip changed. - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="WinVNC4" /> <EventID Qualifiers="0">1</EventID> <Level>4</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2010-05-28T19:49:21.000000000Z" /> <EventRecordID>3008</EventRecordID> <Channel>Application</Channel> <Computer>system1</Computer> <Security /> </System> - <EventData> <Data>Connections</Data> <Data>authenticated: 192.168.0.1::51118, as (anonymous) (Default access)</Data> </EventData> </Event> The event record ID always changes too so I cannot even use that to trigger. Any thoughts? Thanks
May 28th, 2010 11:18pm

I guess that either nobody knows if it is possible, or it is impossible and nobody feels like telling anyone.
Free Windows Admin Tool Kit Click here and download it now
May 30th, 2010 2:55pm

Yes this is what I have been doing already. I just cannot match on a partial string. I can make a custom to match for a whole piece of data but not a piece of it.
May 30th, 2010 6:28pm

For such questions, you may discuss in our Script Center forum. The Official Scripting Guys Forum!Arthur Xie - MSFT
Free Windows Admin Tool Kit Click here and download it now
June 1st, 2010 6:55am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics