Windows Event Log - email notification

Is there an easy way to send an email when a particular severity of event from a particular service hits the Windows server event log? This is on Windows Server 2003, if it makes a difference.

n.b. we do have proper monitoring and alerting in place for production servers at my workplace, but we just a need quick solution for this service in development.

Solution 1:

You could do this with OSSEC, a multi-platform open-source software:

OSSEC is a full platform to monitor and control your systems. It mixes together all the aspects of HIDS (host-based intrusion detection), log monitoring and SIM/SIEM together in a simple, powerful and open source solution.

And for Log Monitoring/Alerting:

Real-time and Configurable Alerts

OSSEC lets customers configure incidents they want to be alerted on which lets them focus on raising the priority of critical incidents over the regular noise on any system. Integration with smtp, sms and syslog allows customers to be on top of alerts by sending these on to e-mail and handheld devices such as cell phones and pagers.

[...]

Every operating system, application, and device on your network generate logs (events) to let you know what is happening. OSSEC collects, analyzes and correlates these logs to let you know if something wrong is going on (attack, misuse, errors, etc).

Hereis an article about OSSEC on 360° Security.

Specialized, commercial alternative: EventTracker (Prism Microssystems):

EventTracker is a complete Security Information and Event Management (SIEM) solution that combines real-time Log Management with powerful Configuration and Change Management in one turnkey software package.

Solution 2:

Here's another silly VBScript creation from me, cobbled together from a couple of other scripts.

Option Explicit

' Main
Dim objShell, objWMIService, objEventSink, dictEventsToMonitor, eventToMonitor

' =====================( Configuration )=====================

' Set to 0 to disable event log reporting of bans / unbans
Const USE_EVENTLOG = 1
Const EVENTLOG_SOURCE = "SimpleEventMonitor"

' SMTP configuration
Const EMAIL_SENDER = "[email protected]"
Const EMAIL_RECIPIENT = "[email protected]"
Const EMAIL_SMTP_SERVER = "smtp-server"
Const EMAIL_SMTP_PORT = 25
Const EMAIL_TIMEOUT = 20

Set dictEventsToMonitor = CreateObject("Scripting.Dictionary")

' Define events that should be monitored. Matches are based on exact matches of all non-NULL fields

' Monitor our own startup and alert based on starting
PushEventToMonitor "100", "Application", EVENTLOG_SOURCE, NULL, NULL, NULL, NULL
PushEventToMonitor "7036", "System", "Service Control Manager", NULL, NULL, NULL, "Telnet service.*(running|stopped).*state"

' ===================( End Configuration )===================


Set objShell = CreateObject("WScript.Shell")

' Create event sink to catchevents
Set objWMIService = GetObject("winmgmts:{(security)}!root/cimv2")
Set objEventSink = WScript.CreateObject("WbemScripting.SWbemSink", "eventSink_")
objWMIService.ExecNotificationQueryAsync objEventSink, "SELECT * FROM __InstanceCreationEvent WHERE TargetInstance ISA 'Win32_NTLogEvent'"

' Loop sleeping for one week, logging an event each week to say we're still alive
While (True)
    LogEvent 100, "INFORMATION", "Simple Event Log Monitor started"
    WScript.Sleep(7 * 24 * 60 * 60 * 1000)
Wend

' Fires each time new events are generated
Sub eventSink_OnObjectReady(objEvent, objWbemAsyncContext)
    Dim evt, field, boolAlert, regexpMessage

    For Each evt In dictEventsToMonitor.Keys
        boolAlert = True

        For Each field In dictEventsToMonitor.Item(evt).Keys
            If UCase(Field) = "MESSAGE" Then 
                Set regexpMessage = new Regexp
                regexpMessage.Pattern = dictEventsToMonitor.Item(evt).Item(Field)
                regexpMessage.IgnoreCase = True
                If NOT regexpMessage.Test(objEvent.TargetInstance.Properties_(Field)) then boolAlert = False
            Else
                If UCase(objEvent.TargetInstance.Properties_(Field)) <> UCase(dictEventsToMonitor.Item(evt).Item(field)) Then boolAlert = False
            End If
        Next ' field

    if boolAlert = True Then
        SendMessage "Simple Event Log Monitor notification from " & objEvent.TargetInstance.ComputerName, _
            "Event ID:       " & objEvent.TargetInstance.EventCode & VbCrLf _
            & "Date/Time:      " & Mid(objEvent.TargetInstance.TimeGenerated, 5, 2) & "/" & Mid(objEvent.TargetInstance.TimeGenerated, 7, 2) & "/" & Mid(objEvent.TargetInstance.TimeGenerated, 1, 4) & " " & Mid(objEvent.TargetInstance.TimeGenerated, 9, 2) & ":" & Mid(objEvent.TargetInstance.TimeGenerated, 11, 2) & ":" & Mid(objEvent.TargetInstance.TimeGenerated, 13, 2)   & VbCrLf _
            & "Computer:       " & objEvent.TargetInstance.ComputerName & vbCrLf _
            & "Event Log:      " & objEvent.TargetInstance.LogFile & vbCrLf _
            & "Event Source:   " & objEvent.TargetInstance.SourceName & vbCrLf _
            & "Event Category: " & objEvent.TargetInstance.CategoryString & vbCrLf _
            & "Event Type:     " & objEvent.TargetInstance.Type & vbCrLf _
            & "User Name:      " & objEvent.TargetInstance.User & vbCrLf _
            & "Message:" & vbCrLf & vbCrLF _
            & objEvent.TargetInstance.Message
        Exit Sub
    End If

    Next ' evt
End Sub

Sub LogEvent(ID, EventType, Message)
    ' Log an event to the Windows event log
    If USE_EVENTLOG Then objShell.Exec "EVENTCREATE /L APPLICATION /SO " & EVENTLOG_SOURCE & " /ID " & ID & " /T " & EventType & " /D """ & Message & """"
End Sub

Sub SendMessage(strSubject, strBody)
    Dim objCDOMessage
    Set objCDOMessage = CreateObject("CDO.Message")

    objCDOMessage.From = EMAIL_SENDER
    objCDOMessage.To = EMAIL_RECIPIENT
    objCDOMessage.Subject = strSubject
    objCDOMessage.Textbody = strBody
    objCDOMessage.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpserver") = EMAIL_SMTP_SERVER
    objCDOMessage.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = EMAIL_SMTP_PORT
    objCDOMessage.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout") = EMAIL_TIMEOUT
    objCDOMessage.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
    objCDOMessage.Configuration.Fields.Update
    objCDOMessage.send
End Sub

Sub PushEventToMonitor(strID, strLog, strSource, strCategory, strType, strUser, strMessagePattern)
    Dim x

    x = dictEventsToMonitor.Count
    Set dictEventsToMonitor.Item(x) = CreateObject("Scripting.Dictionary")
    If NOT IsNull(strID) Then dictEventsToMonitor.Item(x).Add "EventCode", strID
    If NOT IsNull(strLog) Then dictEventsToMonitor.Item(x).Add "LogFile", strLog
    If NOT IsNull(strSource) Then dictEventsToMonitor.Item(x).Add "SourceName", strSource
    If NOT IsNull(strCategory) Then dictEventsToMonitor.Item(x).Add "CategoryString", strCategory
    If NOT IsNull(strType) Then dictEventsToMonitor.Item(x).Add "Type", strType
    If NOT IsNull(strType) Then dictEventsToMonitor.Item(x).Add "User", strUser
    If NOT IsNull(strMessagePattern) Then dictEventsToMonitor.Item(x).Add "Message", strMessagePattern
End Sub

You can run that as a Windows Service if you use something like the Non-Sucking Service Manager or SRVANY to install it. Using NSSM, the comamnd-line would be:

nssm install SimpleEventLogMonitor %SystemRoot%\System32\cscript.exe "\"Pull_path_and_filename_of_script\""

Be sure to substitute in your email recipient, sender, and SMTP server name.

You define the events you want to be alerted on with the "PushEventToMonitor" call. The arguments are: event ID, event log name, source, category, type, user, and a regular expression that can be matched against the log message. I have an example in there that matches the start / stop of the TELNET service, as well as one that will match the startup of the script itself (which logs an event out to the Application Log).

This is a first draft because the one that I wrote for a Customer that's actually "in production" was written on their dime and "belongs" to them. As such, I've re-coded this one (which is actually substantially different from the one used by the Customer) and it may well have stupid bugs lurking in it. I've run it for a little while tonight on some of my systems and I'm not seeing problems.

Maybe I'll eventually make this a little better. It would be nice if it pulled its configuration out of the registry (so it could be controlled with Group Policy) and if it was packaged as an MSI for easy deployment to groups of servers. Oh, well.

Solution 3:

You can do this with a Windows Task
See here http://www.vistax64.com/tutorials/67961-event-viewer-email-notification.html