Write a Windows Event log entry based on a source CSV log file and query

Question

SCENARIO

I've been researching on Google ways to do this but I'm not finding anything, so I really hope SO can help out a netadmin from SF. I see a lot of ways to export FROM the Windows event logs, and ways to write events for custom written apps, but nothing so far for taking existing log files and "converting" them to eventvwr entries.

I'm working on an issue where I need a way to receive notifications/alerts based on the Windows Server DHCP audit logs: http://technet.microsoft.com/en-us/library/dd759178.aspx

The logs are written to C:\windows\system32\DHCP as DhcpSrvLog-Fri ,etc. and auto-rotate on their own.

I need information from this log (particulary event 10's which show a new lease to a client), and will be querying it and comparing it against AD and then either writing to a new CSV file or writing a new eventvwr entry directly.

WHAT'S NEEDED

END RESULT: The end goal here is to receive an email notification when a non-AD joined device gets a DHCP lease address from our DHCP server. More specific details can be found here: https://serverfault.com/questions/550653/windows-dhcp-server-get-notification-when-a-non-ad-joined-device-gets-an-ip-ad

However, in regards to this particular question, what I'm looking for is understanding of how to take an existing file (csv) and write a custom Windows event log entry based on its contents.

I can't seem to find ways to take an existing file as input. Would I have to write something that parses through the DHCP server audit logs and creates various variables that get included in something like Write-Eventlog? If Powershell is the wrong path to go down, I'm open to suggestions.

Frode F. · Accepted Answer · 2013-11-04 22:59:18Z

1

The DHCP server logs are not built the same way as an event, so you have to parse the csv file and create events manually. Since there wasn't any real question here I'll just provide a sample to get you going(untested and incomplete):

Import-Csv filename | Where-Object { $_.ID -eq 10  } | ForEach-Object {
    #If you're using quest module for AD management
    if(!(Get-QADComputer -Name $($_."Host Name"))) {
        Write-EventLog ........
    }
}

answered Nov 4, 2013 at 22:59

Frode F.

55.4k9 gold badges104 silver badges118 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

TheCleaner Over a year ago

that'll help...I'll run with it and let you know what I come up with.

Collectives™ on Stack Overflow

Write a Windows Event log entry based on a source CSV log file and query

SCENARIO

WHAT'S NEEDED

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

SCENARIO

WHAT'S NEEDED

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related