'Set Exchange Profile and Recipients
'on error resume next
Dim sProfile
Dim aRecips
Dim oSink
Dim dEvLast
Dim iTimeThresh

Set oSink = WScript.CreateObject("WbemScripting.SWbemSink","SINK_")
'Parse command line arguments - one command-line parameter should be filename of file in format
'server,log file,event id

'Show usage if parameter is incorrect
if wscript.arguments.count <> 3 and wscript.arguments.count <> 4 then usage
if instr(wscript.arguments(0),"?") then usage
if instr(wscript.arguments(0),"-") then usage
if instr(wscript.arguments(0),"/") then usage
if instr(wscript.arguments(0),"\") then usage

'Get recipient list
aRecips=FiletoArray(wscript.arguments(1))

'Get mapi profile
sProfile=wscript.arguments(2)

'Create dictionary of last events if time specified
if wscript.arguments.count = 4 then 
	iTimeThresh=cdate("00:"&wscript.arguments(3)&":00")
	set dEvLast=Wscript.CreateObject("Scripting.Dictionary")		
end if

wscript.echo
'Parse input file
sFilename=wscript.arguments(0)
aParams=FiletoArray(sFilename)

for each sParam in aParams
	if instr(sParam,",") then
		aTmp=split(sParam,",")
		sComputer=aTmp(0)
		sLog=aTmp(1)
		iEventID=aTmp(2)

		'Add servers to dictionary if time threshold specified
		if wscript.arguments.count = 4 then 
			sKey=lcase(sComputer)&"-"&iEventID	
			if not dEvLast.Exists(sKey) then
				dEvLast.add sKey,0
			end if
		end if

		'Put together query - the within 60 sets a 60 second polling interval
		sQuery="select * from __InstanceCreationEvent Within 60 where TargetInstance ISA 'Win32_NTLogEvent' and TargetInstance.Logfile ='"&sLog&"' and TargetInstance.EventCode = "&iEventID

		'Change query for errors, warnings and informational events rather than event id
		sQuery=replace(sQuery,"TargetInstance.EventCode = I","TargetInstance.Type= 'information'")
		sQuery=replace(sQuery,"TargetInstance.EventCode = i","TargetInstance.Type= 'information'")

		sQuery=replace(sQuery,"TargetInstance.EventCode = W","TargetInstance.Type= 'warning'")
		sQuery=replace(sQuery,"TargetInstance.EventCode = w","TargetInstance.Type= 'warning'")

		sQuery=replace(sQuery,"TargetInstance.EventCode = E","TargetInstance.Type= 'error'")
		sQuery=replace(sQuery,"TargetInstance.EventCode = e","TargetInstance.Type= 'error'")

		call EvAlert(sComputer,sQuery)
	end if
next

wscript.echo "Waiting for events (type ctrl-c to cancel)..."
Do
	'Loop infinitely and wakeup every hour.
	wscript.sleep (3600000)
Loop

Sub EvAlert(sEvComputer,sEvQuery)
	'on error resume next
	'Check for wmi on server

	'Get EventSource
	wscript.echo "Registering with server "&sEvComputer&"..."
	Set oWMI = GetObject("WinMgmts://"&sEvComputer) 
	if err.number <> 0 then
		wscript.echo "Not monitoring sever "&sEvComputer&".  May not have WMI installed."
		wscript.echo "ERROR! Server: "&sEvComputer&",code: "&err.number&",desc: "&err.description
		err.clear
		exit sub
	end if

	set oContext = Wscript.createobject("WbemScripting.SWbemNamedValueSet")
	set oValue=oContext.Add("sCurrentComputer",sEvComputer)
	oWMI.ExecNotificationQueryAsync oSink, sQuery,,,,oContext
	if err.number <> 0 then
		wscript.echo "Not monitoring sever "&sEvComputer&".  Error returned by ExecNotificationQueryAsync."
		wscript.echo "ERROR! Server: "&sEvComputer&",code: "&err.number&",desc: "&err.description
		err.clear
		exit sub
	end if
	set oContext=Nothing
	set oWMI=Nothing
End Sub

Function FiletoArray(sFilename)
	'Returns array of lines in sFilename. sFilename must exist in current directory.
	constForReading = 1 'used for opening files
	ix=0
	set oFSfta=CreateObject("Scripting.FileSystemObject")
	if oFSfta.FileExists(sFilename) then
		set oFilefta=oFSfta.OpenTextFile(sFilename, constForReading)
		do while oFilefta.AtEndOfStream<>true
			sLinefta=oFilefta.ReadLine
			if Len(sLinefta)>0 then
				Redim Preserve aResult(ix)
				aResult(ix)=sLinefta
				ix=ix+1
			end if
		loop
	else
		wscript.echo "Can't find file "&sFilename
		wscript.quit
	end if
	FiletoArray=aResult
	Set oFSfta=Nothing
	Set oFilefta=Nothing
End Function


Sub Notify(sNotifyProfile,sNotifySubject,sNotifyBody,aNotifyRecips)
	'Send Mail with Error Notification using sNotifyProfile, sNotifySubject, sNotifyBody and aNotifyRecips()
	'wscript.echo "Sending mail notification."
	Set oSession = wscript.CreateObject("MAPI.Session")
	oSession.Logon(sNotifyProfile)
	Set oMsg = oSession.Outbox.Messages.Add 
	oMsg.Subject = sNotifySubject
	oMsg.Text = sNotifyBody
	for intx = 0 to ubound (aNotifyRecips)
		Set oOneRecip = oMsg.Recipients.Add 
		oOneRecip.Name = aNotifyRecips(intx)
		oOneRecip.Resolve 
	next
	oMsg.Update 
	oMsg.Send ()
	oSession.Logoff
	set oSession=Nothing
	set oMsg=Nothing
	set oOneRecip=Nothing
End Sub

Sub Notify_IMO(sNotifyProfile,sNotifySubject,sNotifyBody,aNotifyRecips)
	set oOutlook=CreateObject("Outlook.Application")
	set oNS=oOutlook.GetNameSpace("MAPI")
	oNS.Logon sNotifyProfile
	set oMbx=oNS.Folders.Item("Personal Folders")
	set oOutbox=oMbx.Folders("Outbox")
	set oMsg=oOutbox.Items.Add
	for each sNotifyRecip in aNotifyRecips
		oMsg.Recipients.Add sNotifyRecip
	next
	oMsg.Subject=sNotifySubject
	oMsg.Body=sNotifyBody
	oMsg.Send 
	set oExplorer=oOutbox.GetExplorer
	set oCommands=oExplorer.CommandBars
	set oSend=oCommands("Menu Bar").Controls("Tools").Controls("Send")
	oSend.Execute
	oOutlook.Session.logoff
	set oMsg=Nothing
	set oMbx=Nothing
	set oOutlook=Nothing
End Sub

Sub SINK_OnObjectReady(oEvent, oAsyncContext)
	'Format Message and Send
	iCurrentTime=time

	'Check interval if specified
	if wscript.arguments.count = 4 then 
		sKey=lcase(oAsyncContext.item("sCurrentComputer"))&"-"&oEvent.TargetInstance.EventCode
		if dEvLast.Exists(sKey) then
			if IsDate(dEvLast(sKey)) then
				'Don't send notification if last event occurred within threshold
				if cDate(iCurrentTime-iTimeThresh)<cDate(dEvLast(sKey)) then
					wscript.echo date&","&time&",Event ID: "&oEvent.TargetInstance.EventCode&",Computer:  "&oAsyncContext.item("sCurrentComputer")&",No notification sent."
					dEvLast(sKey)=cDate(iCurrentTime)
					exit sub
				end if
			end if
		end if

		'Try again w/event type in case that was criteria
		sKey=lcase(oAsyncContext.item("sCurrentComputer"))&"-"&lcase(left(oEvent.TargetInstance.Type,1))
		if dEvLast.Exists(sKey) then
			if IsDate(dEvLast(sKey)) then
				'Don't send notification if last event occurred within threshold
				if cDate(iCurrentTime-iTimeThresh)<cDate(dEvLast(sKey)) then
					wscript.echo date&","&time&",Event ID: "&oEvent.TargetInstance.EventCode&",Computer:  "&oAsyncContext.item("sCurrentComputer")&",No notification sent."
					dEvLast(sKey)=cDate(iCurrentTime)
					exit sub
				end if
			end if
		end if
	end if

	wscript.echo date&","&iCurrentTime&",Event ID: "&oEvent.TargetInstance.EventCode&",Computer:  "&oAsyncContext.item("sCurrentComputer")&"."
	sSubject="Event ID "&oEvent.TargetInstance.EventCode&" occurred on "&oAsyncContext.item("sCurrentComputer")&"."
	sDate=mid(oEvent.TargetInstance.TimeGenerated,5,2)&"/"&mid(oEvent.TargetInstance.TimeGenerated,7,2)&"/"&left(oEvent.TargetInstance.TimeGenerated,4)
	sTime=mid(oEvent.TargetInstance.TimeGenerated,9,2)&":"&mid(oEvent.TargetInstance.TimeGenerated,11,2)&":"&mid(oEvent.TargetInstance.TimeGenerated,13,2)
	sUser=oEvent.TargetInstance.User
	sCategory=oEvent.TargetInstance.CategoryString
	if IsNull(sCategory) then sCategory="None"
	if IsNull(sUser) then sUser="N/A"
	sBody="Date:      "&sDate&"		Source:    "&oEvent.TargetInstance.SourceName&vbcrlf
	sBody=sBody&"Time:      "&sTime&"		Category:  "&sCategory&vbcrlf
	sBody=sBody&"Type:      "&oEvent.TargetInstance.Type&"		Event ID:  "&oEvent.TargetInstance.EventCode&vbcrlf
	sBody=sBody&"User:      "&sUser&vbcrlf
	sBody=sBody&"Computer:  "&oEvent.TargetInstance.ComputerName&vbcrlf
	if TypeName(oEvent.TargetInstance.Message)="Null" then
		iloop=0
		sInsertionStrings=""
		for each sTmp in oEvent.TargetInstance.InsertionStrings
			if iLoop=0 then
				sInsertionStrings=sTmp
			else
				sInsertionStrings=sInsertionStrings&","&sTmp
			end if
			iloop=iloop+1
		next
		sDesc="The description for Event ID ( "&oEvent.TargetInstance.EventCode&" ) in Source ( "&oEvent.TargetInstance.SourceName&" ) cannot be "&vbcrlf&"found. The local computer may not have the necessary registry information"&vbcrlf&"or message DLL files to display messages from a remote computer."&vbcrlf&"The following information is part of the event: "&sInsertionStrings&"."
	else
		sDesc=oEvent.TargetInstance.Message
	end if
	sBody=sBody&vbcrlf&"Description:"&vbcrlf&sDesc
	'Notify_IMO sProfile,sSubject,Sbody,aRecips
	if wscript.arguments.count = 4 then	
		sKey=lcase(oAsyncContext.item("sCurrentComputer"))&"-"&oEvent.TargetInstance.EventCode
		if dEvLast.Exists(sKey) then dEvLast(sKey)=cDate(iCurrentTime)

		'Try again w/event type in case that was criteria
		sKey=lcase(oAsyncContext.item("sCurrentComputer"))&"-"&lcase(left(oEvent.TargetInstance.Type,1))
		if dEvLast.Exists(sKey) then dEvLast(sKey)=cDate(iCurrentTime)
	end if
	Notify sProfile,sSubject,Sbody,aRecips
	
	'Set oEvent=Nothing
end Sub

'Sub SINK_OnCompleted(HResult, oErr, oCtx)
'	wscript.echo "Done"
'	bDone=True
'End Sub

Sub Usage
	wscript.echo "evalert.vbs eventlog alerter by Ben Herman (http://www.benherman.com)"
	wscript.echo
	wscript.echo "Purpose:"
	wscript.echo "To send an e-mail every time an event occurs on a server."
	wscript.echo
	wscript.echo "Usage:"
	wscript.echo
	wscript.echo "cscript evalert.vbs <server list file> <recipient list file> <mapi profile> [Time in Minutes]"
	wscript.echo 
	wscript.echo "For Example: cscript evalert servers.txt recips.txt ""MS Exchange Settings"""
	wscript.echo 
	wscript.echo 
	wscript.echo "The <server list file> is a text file in the format:"
	wscript.echo "server,log file,event id"
	wscript.echo
	wscript.echo "The letter i, w or e can be used for the event id to alert on any"
	wscript.echo "informational, error or warning events."
	wscript.echo 
	wscript.echo "The <recipient list file> should have a line for each recipient's smtp address."
	wscript.echo "An example server and recipient list file are below"
	wscript.echo "Server list file:"
	wscript.echo "server1,Application,5"
	wscript.echo "server2,System,3"
	wscript.echo "server3,Application,e"
	wscript.echo 
	wscript.echo "Recipient list file:"
	wscript.echo "dcolville@perriergroup.com"
	wscript.echo "bherman@perriergroup.com"
	wscript.echo
	wscript.echo "The optional parameter [time in minutes] can be used to prevent notifications"
	wscript.echo "from being sent if events occur within this number of minutes."
	wscript.quit
End Sub