Event Log Custom Sources
There are many times where we have to write events on the event log in order to log what a script or program is doing, like an automation scrip for example. We want to be able to find out if a script run or not and where the problem was, if any.
I usually create a separate event source on the application log for that purpose, in order to be able to filter the events and not get lost in the application log.
Before adding the logging functionality to your script. lets see a couple of commands that are going to be very helpful.
First. lets see how we can create a new source.
This command will create the source named "MyScript" in the application log.
Another command that may come in handy is:
This command will return true if there is a source named "MyScript" on the application log. I've been using this command when I deploy a script on multiple servers and I want to verify that the source exists.
Please note that the above commands should be executed in an elevated powershell prompt.
And now that we've configured the event source. let's see and example of writing to the log:
Here we are adding a new entry in the application log, under the "MyScript" source with event id 1001, type information and message "Starting script.". You can change the type to error or warning and the event id and message in order to reflect the correct information.
As a best practice, I start the event ids from 1001 in order to be able to insert new event ids before and after the previously configured ids. I also like to document the ids in the start of the script in order to keep track of them.
I usually create a separate event source on the application log for that purpose, in order to be able to filter the events and not get lost in the application log.
Before adding the logging functionality to your script. lets see a couple of commands that are going to be very helpful.
First. lets see how we can create a new source.
New-EventLog -LogName Application -Source "MyScript"
This command will create the source named "MyScript" in the application log.
Another command that may come in handy is:
[System.Diagnostics.EventLog]::SourceExists("MyScript")
This command will return true if there is a source named "MyScript" on the application log. I've been using this command when I deploy a script on multiple servers and I want to verify that the source exists.
Please note that the above commands should be executed in an elevated powershell prompt.
And now that we've configured the event source. let's see and example of writing to the log:
Write-EventLog -LogName Application ` -Source "MyScript" ` -EntryType Information ` -EventId 1001 ` -Message "Staring script."
Here we are adding a new entry in the application log, under the "MyScript" source with event id 1001, type information and message "Starting script.". You can change the type to error or warning and the event id and message in order to reflect the correct information.
As a best practice, I start the event ids from 1001 in order to be able to insert new event ids before and after the previously configured ids. I also like to document the ids in the start of the script in order to keep track of them.
