How to centralize your SQL Server Event Logs.

Question

How to centralize your SQL Server Event Logs.

Viewing 13 posts - 61 through 72 (of 72 total)

You must be logged in to reply to this topic. Login to reply

phildale SSC Journeyman Points: 86 More actions · Answer 1

Geoff A (5/30/2012)
Hi Phil,
Only MSSQL logs will be forwarded to the central server. That is a SQL Server Agent function.
SQL Server Agent will not forward non SQL Application log entries.
The modification to the script will work, but only on the server where the error occurs.
Thanks

Thanks for the quick reply Geoff.

I'm having a little trouble trying to grasp the concept. Maybe I'm misunderstanding SQL Server Agent's role in this.

I only want to monitor one SQL Server, and write the errors into a database on that server. In this case, all errors are occurring on that one server, the server that is monitoring for errors. But the script isn't picking up non-SQL specific errors. If the script is reading directly from wherever the Event Viewer Application log is, it shouldn't matter that the errors are not SQL specific?

Thanks

Phil

Geoff A SSChampion Points: 11511 More actions · Answer 2

try this script instead;

query = "Select * from __InstanceCreationEvent" _

& " " & "where TargetInstance isa 'Win32_NTLogEvent'" _

& " " & "and (TargetInstance.Logfile = 'Application' or TargetInstance.Logfile = 'System')" _

& " " & "and (TargetInstance.EventType = 1 or TargetInstance.EventType = 2)"

phildale SSC Journeyman Points: 86 More actions · Answer 3

Geoff A (5/30/2012)
try this script instead;
query = "Select * from __InstanceCreationEvent" _
& " " & "where TargetInstance isa 'Win32_NTLogEvent'" _
& " " & "and (TargetInstance.Logfile = 'Application' or TargetInstance.Logfile = 'System')" _
& " " & "and (TargetInstance.EventType = 1 or TargetInstance.EventType = 2)"

Thanks for that, I've given it a try but I'm having the same results.

I thought the package might have cached the script or something so I recreated it with the correct script from the beginning, and it's still ignoring non-SQL errors.

Really confusing one.

adjas SSC Enthusiast Points: 136 More actions · Answer 4

Hi,

I am testing the script on one server and it works.

However it inserts four records for the same event.

Any thoughts?

Adam

chanjcc Valued Member Points: 67 More actions · Answer 5

c:\>cscript EventLog2DB.vbs

Microsoft (R) Windows Script Host Version 5.8

Step 0:

Msg 3201, Level 16, State 1, Line 1

Cannot open backup device 'f:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Backup\11'. Operating system error 3(The system cannot find the path specified.).

Msg 3013, Level 16, State 1, Line 1

BACKUP DATABASE is terminating abnormally.

Error in Step 0 triggers the following error. Please help

c:\EventLog2DB.vbs(30, 2) Microsoft OLE DB Provider for SQL Server: Conversion failed when converting the varchar value 'kF' to data type tinyint.

lsatchell Grasshopper Points: 13 More actions · Answer 6

This article was the subjectline feature article 2nd May 2014 SQLServerCentral e-mail newsletter.

Come on guys, a circa 2010 solution featuring a VBscript!? Where's the powershell updated equivalent? VBscript should be relegated to Office macros by now....

Regards, Leigh.

Dan Guzman SSCommitted Points: 1506 More actions · Answer 7

Any thoughts to using PowerShell instead of VBScript?

buddy__a Hall of Fame Points: 3222 More actions · Answer 8

Any thoughts on using Powershell instead of VB?

Edit:

Apparently DanGuzman and I both had the same thought while not reading the entire thread.

Jeff Moden SSC Guru Points: 1004378 More actions · Answer 9

lsatchell (5/1/2014)
This article was the subjectline feature article 2nd May 2014 SQLServerCentral e-mail newsletter.
Come on guys, a circa 2010 solution featuring a VBscript!? Where's the powershell updated equivalent? VBscript should be relegated to Office macros by now....
Regards, Leigh.

Dan Guzman-481633 (5/2/2014)
Any thoughts to using PowerShell instead of VBScript?

buddy__a (5/2/2014)
Any thoughts on using Powershell instead of VB?
Edit:
Apparently DanGuzman and I both had the same thought while not reading the entire thread.

Why? It still works even after more than 3 years. 🙂 Would PoSH make it better in some way? If so, I'm all for it. If not, I wouldn't change it.

--Jeff Moden

RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

Change is inevitable... Change for the better is not.

Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

buddy__a Hall of Fame Points: 3222 More actions · Answer 10

Jeff Moden (5/2/2014)
lsatchell (5/1/2014)
This article was the subjectline feature article 2nd May 2014 SQLServerCentral e-mail newsletter.
Come on guys, a circa 2010 solution featuring a VBscript!? Where's the powershell updated equivalent? VBscript should be relegated to Office macros by now....
Regards, Leigh.
Dan Guzman-481633 (5/2/2014)
Any thoughts to using PowerShell instead of VBScript?
buddy__a (5/2/2014)
Any thoughts on using Powershell instead of VB?
Edit:
Apparently DanGuzman and I both had the same thought while not reading the entire thread.
Why? It still works even after more than 3 years. 🙂 Would PoSH make it better in some way? If so, I'm all for it. If not, I wouldn't change it.

Great point, I'm going to tell the company I'm working for to stop upgrading all those working VB6 apps. I'm not sure why Geoff bothered to use VBScript in the first place when he could have done this all in an assembly language app.

Or you could replace stuff like this:

Set objWMIService = GetObject("winmgmts:" _

& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

' get the events we want

query = "Select * from __InstanceCreationEvent" _

& " " & "where TargetInstance isa 'Win32_NTLogEvent'" _

& " " & "and TargetInstance.Logfile = 'Application'" _

& " " & "and (TargetInstance.EventType = 1 or TargetInstance.EventType = 2)" _

& " " & "and (TargetInstance.SourceName like 'MSSQL%')"

' get ready to insert into our DBA table

Set colMonitoredEvents = objWMIService.ExecNotificationQuery(query)

with this:

Get-EventLog -LogName Application -Source "MSSQL*" -EntryType Warning,Error

I don't get technology workers that say stuff like this. Working with the bottom code is much easier (and that's the whole purpose of technology) than all the string concatenated stuff above. Also, everyone new to the administration game (be it server admin or database admin) is learning Powershell, not VBScript. VBScript is dead, the new king is Powershell and it is so much better than VBScript. Geoff did a great job but there is nothing wrong with upgrading to new technology.

jswong05 Hall of Fame Points: 3553 More actions · Answer 11

1) You can see how I used Powershell to accomplish this kind of things from one centralized server pulling at SQLSaturday#308.

2) If the VBScript agent has to be delivered to each every host, that is a drag. No, no.

Jason
http://dbace.us
😛

quackhandle1975 SSChampion Points: 11055 More actions · Answer 12

Great article, thanks.

qh

[font="Tahoma"]Who looks outside, dreams; who looks inside, awakes. – Carl Jung.[/font]

Santhoshkumar KB SSCertifiable Points: 5066 More actions · Answer 13

The setup is complete.

When I test with the following statement, 8 SAME records are inserted.

raiserror ('working great',16,1) with log

Everytime I run, 8 records are being inserted. Is it normal or am I missing something?

Thanks,
Santhosh

Human Knowledge Belongs To The World !!