📄 Viewing: evtsystem

##########################################################################
# $Id: evtsystem,v 1.3 2008/06/30 23:07:51 kirk Exp $
##########################################################################
# $Log: evtsystem,v $
# Revision 1.3  2008/06/30 23:07:51  kirk
# fixed copyright holders for files where I know who they should be
#
# Revision 1.2  2008/03/24 23:31:26  kirk
# added copyright/license notice to each script
#
# Revision 1.1  2007/04/28 22:50:24  bjorn
# Added files for Windows Event Log, by Orion Poplawski.  These are for
# Windows events logged to a server, using Snare Agent or similar.
#
##########################################################################

########################################################
## Copyright (c) 2008 Orion Poplawski
## Covered under the included MIT/X-Consortium License:
##    http://www.opensource.org/licenses/mit-license.php
## All modifications and contributions by other persons to
## this script are assumed to have been donated to the
## Logwatch project and thus assume the above copyright
## and licensing terms.  If you want to make contributions
## under your own copyright or a different license this
## must be explicitly stated in the contribution an the
## Logwatch project reserves the right to not accept such
## contributions.  If you have made significant
## contributions to this script and want to claim
## copyright please contact logwatch-devel@lists.sourceforge.net.
#########################################################

my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;

while (defined($ThisLine = <STDIN>)) {
   my ($Hostname,$Criticality,$SourceName,$DateTime,$EventID,$System,$UserName,$SIDType,$EventLogType,$CategoryString,$DataString,$ExpandedString,$Extra);
   #Determine format
   if ($ThisLine =~ /MSWinEventLog\[/) {  # Snare 4
      #Parse
      ($Criticality,$SourceName,$DateTime,$EventID,$System,$UserName,$SIDType,$EventLogType,$Hostname,$CategoryString,$DataString,$ExpandedString,$Extra) =
         ($ThisLine =~ /MSWinEventLog\[(\d+)\]:(\w+)\t\d+\t([^\t]+)\t(\d+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)/);
   } elsif ($ThisLine =~ /MSWinEventLog\t/) { # Snare 3
      #Parse
      ($Criticality,$SourceName,$DateTime,$EventID,$System,$UserName,$SIDType,$EventLogType,$Hostname,$CategoryString,$DataString,$ExpandedString,$Extra) =
         ($ThisLine =~ /MSWinEventLog\t(\d+)\t(\w+)\t\d+\t([^\t]+)\t(\d+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t([^\t]+)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)\t?([^\t]*)/);
   }
   if (!defined($Hostname)) {
      print STDERR "Cannot parse $ThisLine";
      next;
   }
   #print STDERR "ExpandedString = $ExpandedString\n";

   if ($System =~ /Application Popup/) {
      #Ignore these
      next if $ExpandedString =~ /Initialization Failed : The application failed to initialize because the window station is shutting down/;
   }

   if ($System =~ /EventLog/) {
      #Ignore these
      next if $ExpandedString =~ /Microsoft \(R\) Windows \(R\) \d+\.\d+\. \d+ Service Pack \d/;
      next if $ExpandedString =~ /The Event log service was started./;
      next if $ExpandedString =~ /The Event log service was stopped./;
      next if $ExpandedString =~ /The system uptime is \d+ seconds/;
   }

   if ($System =~ /Microsoft-Windows-Kernel-Power/) {
      #High Detail
      next if $ExpandedString =~ /The system is entering sleep/ and $Detail < 10;
   }

   if ($System =~ /Microsoft-Windows-Power-Troubleshooter/) {
      #High Detail
      next if $ExpandedString =~ /The system has resumed from sleep/ and $Detail < 10;
   }

   if ($System =~ /Microsoft-Windows-Time-Service/) {
      #High Detail
      next if $ExpandedString =~ /The time provider NtpClient is currently receiving valid time data from/ and $Detail < 10;
   }

   if ($System =~ /Microsoft-Windows-Winlogon/) {
      #High Detail
      next if $ExpandedString =~ /User \w+ Notification for Customer Experience Improvement Program/ and $Detail < 10;
   }

   if ($System =~ /Virtual Disk Service/) {
      #High Detail
      next if $ExpandedString =~ /Service (started|stopped)/ and $Detail < 10;
   }

   if ($System =~ /Service Control Manager/) {
      #Ignore these
      next if $ExpandedString =~ /The (.*) service entered the running state./;
      next if $ExpandedString =~ /The (.*) service entered the stopped state./;
      next if $ExpandedString =~ /The (.*) service was successfully sent a start control./;
      next if $ExpandedString =~ /The (.*) service was successfully sent a stop control./;
   }

   # Add to the list
   $Systems{$System}->{"$Hostname $ExpandedString"}++;
}

if (keys %Systems) {
   foreach $System (sort(keys %Systems)) {
      print "\n$System\n";
      foreach $Error (sort(keys %{$Systems{$System}})) {
         print "    $Error : $Systems{$System}->{$Error} Times\n";
      }
   }
}

exit(0);

# vi: shiftwidth=3 tabstop=3 syntax=perl et
# Local Variables:
# mode: perl
# perl-indent-level: 3
# indent-tabs-mode: nil
# End:

🌑 DarkStealth — WP Plugin Edition