Parsing Windows Event Logs

I had a major problem. I have to “analyze” Windows event logs from several Microsoft Windows Servers in a centralised location.

Procedures:
Open Event Viewer
Browse to folder
Open hostname-year-month-day.evt
Filter Errors and Failure Audits
Repeat for the rest of the servers

I was lucky to stumble upon the Log Parser, a command-line which allows SQL queries to be run against log files and dump the required results into simple csv files.
“C:\program files\log parser 2.2\logparser.exe” -i:evt “select EventLog, TimeGenerated, EventID, EventTypeName, EventCategoryName, SourceName, Strings, ComputerName, SID, Message into %2 from %1 where EventTypeName like ‘Error%%'” -o:csv -resolveSIDs:on -direction:BW

Where %1 refers to your source and %2 to your destination.

Quoted from my friend “If you have to click on the same thing more than 2 times, automate it.”

HSRP

Having a “small” problem with HSRP.

ASCII Network Diagram

[switch-a1]--[router-a1]--[ISP 1 Cloud]--[router-b1]--[switch-b1]--- Active Link
|          |                           |              |
[switch-a2]--[router-a2]--[ISP 1 Cloud]--[router-b1]--[switch-b2]--- Standby Link

I configured HSRP all on devices. My problem is, when a switch-a1 fails, router-a1 fails over to router-a2. but router-b1 will not fail over as the link between router-a1 and router-b1 via ISP 1 is still up.

I tried HSRP tracking, but the best tracking method I found is IP Route Reachability.
Track shows the object is up if the gateway to that network is still in your routing table.

so even configuring “track 100 ip route 10.2.2.2/32 reachability” doesn’t work, as the gateway is added manually as a static route.

Sample Config from Cisco.

Continue reading “HSRP”