We would like to be able to pull the event logs into KACE when lookging at Computers in the Inventory tab. Is this possible?

Answer Summary:
0 Comments   [ - ] Hide Comments


Please log in to comment

Answer this question or Comment on this question for clarity



You can do a custom inventory for almost anything. This will check the log for successful installs.

ShellCommandTextReturn(powershell get-eventlog Application | where-object {$_.EventID -eq "11707"}|select-object TimeGenerated,message|Format-List)
Answered 08/26/2013 by: dugullett
Red Belt

  • Is there anything inside KACE to pull logs or config to do this?
    • Not by defualt, but running something like this will show in the machine inventory under "Custom Inventory Fields". Just make sure you select your correct OS.
  • Have you tried using the Scripting > Configuration Policy and Eventlog Reporter Wizard. It will pull the standard logs but you can adjust the vbs script to pull more and it will attach it as an uploaded file under inventory for the machine and in the uploaded file link.

    it will override every time you run it though unless you are able to change the vbs to change the name locally before uploading it. I wouldn't leave it to rename infinitely. I would have a set number and when it exceeds, delete the oldest file.
    • I am having a problem with Eventlog Reporter Wizard. For Application and System logs it works fine, however, for Security logs it fails. The text file it creates is empty.
  • Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4624)]] and *[EventData[Data[@Name='TargetUserName'] and (Data ='')]]" |group eventid -noelement | sort count

    how to run this command in KACE , powershell script throws an error
Please log in to comment