We want to email our helpdesk when a user has reached their Windows 2000 disk quota. I have set host monitor up to do this, however, the only indication of which user is at quota is in the "User" description of the event, which is not mailed over as part of %Reply% - only the Description field is. Can you include all of the variables, such as %EventDate%, %EventSource%, %EventTime%, %EventCategory%, %EventType%, %EventID%, %EventUser%, %EventComputer% etc?
In our case, %EventUser% would be the one we would want -
Thanks,
Greg
<font size=-1>[ This Message was edited by: agressiv on 2002-12-17 13:06 ]</font>
Feature Request: Get Username from NT Event log
Still no %NTEventUser% variable - can this be added?
Greg
--------------
following variables have sense for "NT Event Log" test only, they represent parameters of the last "Bad" event detected:
%NTEventSource% Event source. Identifies the software that logged the event
%NTEventComp% Name of the computer where the event occurred
%NTEventTime% Time of the event
%NTEventType% Type of the event
%NTEventID% Event identifier
%NTEventText% Event description
--------------
Greg
--------------
following variables have sense for "NT Event Log" test only, they represent parameters of the last "Bad" event detected:
%NTEventSource% Event source. Identifies the software that logged the event
%NTEventComp% Name of the computer where the event occurred
%NTEventTime% Time of the event
%NTEventType% Type of the event
%NTEventID% Event identifier
%NTEventText% Event description
--------------
This is %REPLY% from EventLog
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 13.01.2003
Time: 10:58:42
User: NT AUTHORITYSYSTEM
Computer: SERVER1
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: User1
Domain: WORKGROUP
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: \USER1
How to get "User Name: User1" and "Workstation Name: \USER1"
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 13.01.2003
Time: 10:58:42
User: NT AUTHORITYSYSTEM
Computer: SERVER1
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: User1
Domain: WORKGROUP
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: \USER1
How to get "User Name: User1" and "Workstation Name: \USER1"
-
Guest
