########################################################################## # $Id: evtsystem,v 1.1 2007/04/28 22:50:24 bjorn Exp $ ########################################################################## # $Log: evtsystem,v $ # Revision 1.1 2007/04/28 22:50:24 bjorn # Added files for Windows Event Log, by Orion Poplawski. These are for # Windows events logged to a server, using Snare Agent or similar. # ########################################################################## my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0; while (defined($ThisLine = <STDIN>)) { #Parse my ($Hostname,$Criticality,$SourceName,$DateTime,$EventID,$System,$UserName,$SIDType,$EventLogType,$ComputerName,$CategoryString,$DataString,$ExpandedString,$Extra) = ($ThisLine =~ /(\w+)\sMSWinEventLog\t(\d+)\t(\w+)\t\d+\t([^\t]+)\t(\d+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)/); if (!defined($Hostname)) { print STDERR "Cannot parse $ThisLine"; next; } #print STDERR "ExpandedString = $ExpandedString\n"; if ($System =~ /Application Popup/) { #Ignore these next if $ExpandedString =~ /Initialization Failed : The application failed to initialize because the window station is shutting down/; } if ($System =~ /EventLog/) { #Ignore these next if $ExpandedString =~ /Microsoft \(R\) Windows \(R\) \d+\.\d+\. \d+ Service Pack \d/; next if $ExpandedString =~ /The Event log service was started./; next if $ExpandedString =~ /The Event log service was stopped./; } if ($System =~ /Service Control Manager/) { #Ignore these next if $ExpandedString =~ /The (.*) service entered the running state./; next if $ExpandedString =~ /The (.*) service entered the stopped state./; next if $ExpandedString =~ /The (.*) service was successfully sent a start control./; next if $ExpandedString =~ /The (.*) service was successfully sent a stop control./; } # Add to the list $Systems{$System}->{"$Hostname $ExpandedString"}++; } if (keys %Systems) { foreach $System (sort(keys %Systems)) { print "\n$System\n"; foreach $Error (sort(keys %{$Systems{$System}})) { print " $Error : $Systems{$System}->{$Error} Times\n"; } } } exit(0); # vi: shiftwidth=3 tabstop=3 syntax=perl et