Product documentation
uberAgent
Current Release (7.3.1) 7.3.0 7.2.1 7.2.0 7.1.2 7.1.1 7.1.0 7.0.2 7.0.1 7.0.0
View PDF

Querying Windows Event Log

July 25, 2024
Contributed by: 
C

A question we get asked quite often is whether uberAgent is able to query Windows Event Log for specific events IDs. This functionality is not in the product, as Splunk, uberAgent’s primary backend, has this built-in. Hence we generally recommend making use of Splunk’s capabilities.

However, not all of our customers have Universal Forwarder, Splunk’s client software, deployed to their endpoints, mostly for performance reasons. If that is the case for you, too, then this practice guide should be of interest. If you do have Splunk’s Universal Forwarder deployed, please use its functionality instead. UF is more efficient than the script-based solution presented in this article.

The scripts listed in this guide are managed in vast limits’ public GitHub repository.

Collect Event IDs With a Custom Script

As Windows Event Log data is not part of uberAgent’s default data set, we are using the agent’s custom script functionality.

In a nutshell, the uberAgent custom scripts feature executes any script you like and sends the output to Splunk. This works with any scripting engine, of course. In this case, we are using PowerShell.

The following script queries Event Log for a given event ID in a specific event log (Application, System, etc.). It also needs an interval in which it should search. Due to the parameters, you can use that script to query arbitrary events and don’t need a new script for each. The required parameters are passed to the script through an uberAgent timer.

PARAM
(
    [Parameter(Mandatory = $true)]
    [System.Int32]$EventID,

    [Parameter(Mandatory = $true)]
    [System.String]$EventLog,

    [Parameter(Mandatory = $true)]
    [System.Int32]$IntervalMS
)

$IntervalMS = -$IntervalMS

$StartTime=$(get-date).AddMilliseconds($IntervalMS)

$Filter= @{
    LogName="$EventLog"
    StartTime=$StartTime
    Id=$EventID
}

$Events = Get-WinEvent -FilterHashtable $Filter -ErrorAction SilentlyContinue

if (@($Events).Count -gt 0)
{
    foreach ($Event in $Events)
    {
        [Hashtable]$Output = @{
            'ProviderName' = "`"$($Event.ProviderName)`""
            'Id' = $Event.id
            'LevelDisplayName' = $Event.LevelDisplayName
            'LogName' = $Event.LogName
            'Message' = "`"$($Event.Message)`""
            'TimeCreated' = "`"$($Event.TimeCreated)`""
            'TaskDisplayName' = "`"$($Event.TaskDisplayName)`""
        }
        Write-Output $($Output.keys.foreach({"$_=$($Output.$_)"}) -join ' ')

    }
}
<!--NeedCopy-->

Save the script somewhere. For this example, we save the script as C:\Program Files\vast limits\uberAgent\Scripts\Get-WinEvent.ps1.

Configure uberAgent to Run the Script

Create a new timer in uberAgent’s configuration. With the settings shown below, the script will be executed every five minutes.

[Timer]
Name              = Get-WinEvent
Interval          = 300000
Script            = powershell.exe -executionpolicy bypass -file "C:\Program Files\vast limits\uberAgent\Scripts\Get-WinEvent.ps1" -EventID 1000 -EventLog "Application" -IntervalMS 300000
ScriptContext     = Session0AsSystem
<!--NeedCopy-->

Note that you define the parameters in the Script setting. The parameter IntervalMS should be the same number of milliseconds as the setting Interval.

Splunk it

Once the data is in Splunk it can be used to search for Windows Events.

uberAgent-winevent-small

Querying Windows Event Log
July 25, 2024
Contributed by: 
C
July 25, 2024
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.