[PRTG] Get Windows Events

#___ ___ _____ ___
#| _ \ _ \_   _/ __|
#|  _/   / | || (_ |
#|_| |_|_\ |_| \___|
#    NETWORK MONITOR
#-------------------
#(c) 2014 Stephan Linke, Paessler AG
<#
   .SYNOPSIS
   Reads the windows eventlog and filters for the specified events.

   .DESCRIPTION
   This custom sensor for PRTG will read the given EventLog file and search it
   for the defined events. It also allows to error if the last event found has a certain ID or
   Message. Make sure you set "Use credentials of parent device" in the sensors security settings".

   .PARAMETER ComputerName
   The computer whose event log you want to check

   .PARAMETER Channel
   The log name that is used by the application

   .PARAMETER ProviderName
   The application that you want to watch

   .PARAMETER Levels
   The Loglevels you want to include in the search

   .PARAMETER EventID
   The event IDs you want to filter. Seperate multiple IDs with comma

   .PARAMETER EnableExceptId
   This will allow you to enter a number of (or none) event Ids to ignore (i.e. remove from the list after retrieving them) as EventIDs.
   Those IDs will not be considered for the sensor state! If you want to do so, simply use the -EnableExceptId switch upon calling the script.

   .PARAMETER WarningEvents
   The event IDs you want to raise a warning when found. Those IDs also have to be included in the event ids

   .PARAMETER ErrorEvents
   The event IDs you want to raise a error when found. Those IDs also have to be included in the event ids

   .PARAMETER MaxAge
   The age of the Logfile in hours

   .PARAMETER LimitEntries
   Maximum number of log entries to be checked (order is new -> old)

   .PARAMETER StateBasedOnLastID
   If this parameter is set, not the sheer number of events will decide if the sensor will go into error or warning state,
   but only the event id of the last entry found. This is useful for RAID controllers, etc.

   .PARAMETER StateBasedOnLastMessage
   If this parameter is set, not the sheer number of events will decide if the sensor will go into error or warning state,
   but only the message of the last entry found. This is useful if messages have the same event ID for errors and information events.

   .OUTPUTS
   <number of entries found>:<entries> found in the event log. Last message: <last entry message>

   .EXAMPLE
   C:\PS> .\Get-Events.ps1  -ComputerName %host -Username "%windowsdomain\%windowsuser" -Password "%windowspassword" -ProviderName "Microsoft-Windows-Immersive-Shell" -Channel "Microsoft-Windows-TWinUI/Operational" -LimitEntries 1 -MaxAge 1 -EventID 1719 -Level 4

   .EXAMPLE
   C:\PS> .\Get-Events.ps1  -ComputerName %host -Username "%windowsdomain\%windowsuser" -Password "%windowspassword" -ProviderName "Microsoft-Windows-Immersive-Shell" -Channel "Microsoft-Windows-TWinUI/Operational" -LimitEntries 1 -MaxAge 1 -EventID 1719 -Level 4 -StateBasedOnLastEntry
#>

#region Requirements
#Requires -Version 3.0
#endregion

param(
    [string]$ComputerName   = "",
    [string[]]$Channel      = @(""),
    [string[]]$ProviderName = @(""),
    [int[]]$EventID         = @(),
    [switch]$EnableExceptID   = $False,
    [switch]$EnableExceptChannel = $False,
    [switch]$EnableExceptProvider= $False,
    [int[]]$WarningEvents   = @(),
    [int[]]$ErrorEvents     = @(),
    [string[]]$ErrorStrings = @(),
    [string[]]$WarningStrings = @(),
    [int[]]$Levels          = @(2),
    [float]$MaxAge          = 20,
    [int]$LimitEntries      = 10,
    [switch]$AlwaysShowMessage,
    [switch]$StateBasedOnLastMessage,
    [switch]$StateBasedOnLastEventID
)
[System.Threading.Thread]::CurrentThread.CurrentCulture = New-Object "System.Globalization.CultureInfo" "en-US"
$ExitCode = 0
$Message = ""

# This will retrieve the event log entries
# based on channel, provider and events ID.
#######################################
function readEventLog(){
    ## create an eventfilter object array for the

    if(!($EnableExceptID)){
        $EventFilter = @{
            ProviderName=$ProviderName;
            LogName=$Channel;
            ID=$EventID;
            Level=$Levels;
            StartTime=(get-date).AddHours(-$MaxAge)
        }
    }

    else{
    $EventFilter = @{
            ProviderName=$ProviderName;
            LogName=$Channel;
            Level=$Levels;
            StartTime=(get-date).AddHours(-$MaxAge)
        }
    }

    if($EnableExceptChannel){
            $Events = ($Events | Where { $Channel -notcontains $_.LogName });
        }
    if($EnableExceptProvider){
            $Events = ($Events | Where { $ProviderName -notcontains $_.ProviderName });
        }


    try{
        $Events = (Get-WinEvent -ComputerName $ComputerName -FilterHashTable $EventFilter -MaxEvents $LimitEntries -EA silentlycontinue)

        if($EnableExceptID){
            $Events = ($Events | Where { $EventID -notcontains $_.Id });
        }

        return $Events;
    }
    catch [Exception]{
        Write-Host "0:Can't find anything for $ProviderName in your $Channel eventlog. Please check Log name, Provider, Log ID, EventID, ComputerName and Credentials"
        Write-Host $_.Exception.Message
        Exit 2;
    }
}

# This will evaluate the results from the above
# function and return the sensor value
#######################################
function evaluateLogResults(){

        $Events = (readEventLog);
        $Counter = $Events.Count

        # Always show the last message when enabled
        if(($AlwaysShowMessage) -and ($Counter -ne 0)){
        $LastMessage = ($Events[0].Message.Remove($Events[0].Message.Length / 6)+"..." -replace "`n|`r")
        $Message = "(Last entry: "+$LastMessage+")"
        }

        # Search for error and warning IDs
        if(($Counter -ne 0) -and (($StateBasedOnLastEventID)) -and (-not($StateBasedOnLastMessage))){
                switch ($Events[0].Id){
                    {$ErrorEvents -contains $Events[0].Id}{ Write-Host $Counter":Critical event found: $($Message)"; $ExitCode = 2; return}
                    {$WarningEvents -contains $Events[0].Id}{ Write-Host $Counter":Warning event found: $($Message)"; $ExitCode = 1; return}
                }
        }

        # Search for messages that contain the error and warning strings
        elseif(($Counter -ne 0) -and ($StateBasedOnLastMessage)){
        foreach($String in $ErrorStrings){
                    if($Events[0].Message -match "($String)"){ Write-Host ("{0}:Critical event found: {1}" -f $Counter,$Message); $ExitCode = 2; return; } }
                foreach($String in $WarningStrings){
                    if($Events[0].Message -match "($String)"){ Write-Host ("{0}:Warning event found: {1}" -f $Counter,$Message); $ExitCode = 2; return; } }
        }

        # Search for messages that contain the error and warning strings and make the state message based
        elseif(($Counter -ne 0) -and (($StateBasedOnLastMessage) -and ($StateBasedOnLastID))){
        switch ($Events[0].Id){
                    {($ErrorEvents -contains $Events[0].Id) -and ($Events[0].Message -match $ErrorStrings)} {
                        Write-Host ("{0}:Critical event found: {1}" -f $Counter,$Message); $ExitCode = 1; return}
                    {($WarningEvents -contains $Events[0].Id) -and ($Events[0].Message -match $WarningStrings)} {
                        Write-Host ("{0}:Warning event found: {1}" -f $Counter,$Message); $ExitCode = 2; return}
                    }
        }

        switch ($Counter){
                {$Counter -eq 0}{ Write-Host ("{0}:No log entries found" -f $Counter); $ExitCode = 0; return }
                {$Counter -eq 1}{ Write-Host ("{0}:{0} log entry found in the last {1} hours {2}" -f $Counter, $MaxAge, $Message); $ExitCode = 0; return; }
                {$Counter -gt 1}{ Write-Host ("{0}:{0} log entries found in the last {1} hours {2}" -f $Counter, $MaxAge, $Message); $ExitCode = 0; return; }
            }

}

# Action!
evaluateLogResults;
exit $ExitCode;