One of the new features of Server 2008 is the ability to attach a task to a specific event in the event logs. One of the actions available is to send an email through a SMTP server.
This is working great, however it would be ideal if in the message body, the Event contents could be placed. I have tried using $eventdescription and %eventdescription%, but those are just shots in the dark. Any amount of googling produces no results.
Does anyone know if this is possible?
Update: Sparks' suggestion below is a step in the right direction I believe, however that method doesn't seem to work for all values. For example, I can pull the RecordID, Severity and Channel as shown, but I can't use the same method to retreive the EventID, or most importantly the description.
Here's the raw XML from one event:
[Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"]
[System]
[Provider Name="DFSR" /]
[EventID Qualifiers="16384"]4412[/EventID]
[Level]4[/Level]
[Task]0[/Task]
[Keywords]0x80000000000000[/Keywords]
[TimeCreated SystemTime="2009-05-14T18:18:09.000Z" /]
[EventRecordID]45692[/EventRecordID]
[Channel]DFS Replication[/Channel]
[Computer]servername.domain.com[/Computer]
[Security /]
[/System]
[EventData]
[Data]9046C3F4-843E-4A53-B941-4B20764072E5[/Data]
[Data]D:\departments\Geomatics\Plan Quality\Data Processing\CG3533017 2009-05-13 KT FIXED[/Data]
[Data]D:\departments[/Data]
[Data]{26D5F604-E603-4F87-8EC3-DE9A945DA8FD}-v927199[/Data]
[Data]Departments[/Data]
[Data]domain.ca\files\departments[/Data]
[Data]B8242CE2-F5EB-47DA-BA5B-1DD2F7EE3AB9[/Data]
[Data]DFAA7A54-66CB-4C31-81A0-0F861382C32C[/Data]
[Data]CG3533017 2009-05-13-{26D5F604-E603-4F87-8EC3-DE9A945DA8FD}-v927199[/Data]
[/EventData]
[/Event]
I have tried using a ValueQuery for EventData, but it returns no data.
