Export and Email Event log Information

Step1 – Export event details to a txt file

You can use the wevtutil command to export the specified event ID log into a file. 

The following command exports event ID 4648 or 4729 from Security event to a Security_Event.txt file. 

wevtutil qe security /rd:true /f:text /c:1 /q:"*[System[Provider[@Name='Microsoft-Windows-SecurityAuditing'] and (EventID=4648 or EventID=4729)]]" >C:\Security_Event.txt

 

Security_Event.txt

Setp2 – Email Alert
The second step is to email this file as an attachment.  You can use the following procedure to generate an email alert: (Attach Task To This Event)

http://portal.sivarajan.com/2010/04/generate-email-alert-to-event-attach.html

wevtutil Command Reference:

http://technet.microsoft.com/en-us/library/cc732848(WS.10).aspx

Read More

Generate an email Alert to an Event - Attach Task To This Event

In windows 7 and windows 2008, you can generate an email alert when an event meets specified criteria in the event log.  Here is the procedure.

From Event Viewer –>Windows Logs –> Right click on the event and select  Attach Task To This Event option. 

From the Create Basic Task Wizard, select Send an e-mail option as the Action task. 

Then configure your email properties. 

When you complete this task, it will create a task in the Task Scheduler.  You can see the details in the following screenshot:

Related Blogs and Articles:

http://portal.sivarajan.com/2010/06/export-and-email-event-log-information.html

Read More