Library Pack Header

This Library pack is a collection of different Remote Action scripts which provide some information of the devices’ health and useful insights for troubleshooting common Windows issues.\nPlease use the links on the left menu to learn more about the function and range of action of each script.

Event Logs

Returns a given number of entries from the Windows Event Log and redirects the output to a text file that can be retrieved from the device (the path to the file is shown in the output of the Remote Action). Overrides the pre-existing file if the OutputDir is the path of a previous Remote Action execution. If no items matched the event log search criteria, file will not be created or overwritten. Useful for troubleshooting issues by analyzing events that occurred in the past.

The number of events that the Remote Action will obtain (up to 1000)

Number of events

Location where the output file will be created in the local machine

Output directory

This can be an Application, System or a custom log name

Log name

The Provider Name registered with the event log as source of entries (Optional). This field accept wildcards. Use '""' (two double-quotes) if you do not wish to filter by 'ProviderName'

Provider name

The severity level associated to the entries in the event log (Optional). The accepted values are Critical, Error, Warning and Information. When a level is specified, the Remote Action returns the events having either that severity level or a higher one. Use '"' (two double-quotes) if you do not wish to filter by 'SeverityLevel'

Severity level

The ID used to define the uniquely identifiable events that a Windows computer can encounter (Optional). This field should be one integer value. Use '""' (two double-quotes) if you do not wish to filter by 'EventID'

Event ID

The latest date a collected event can have (Optional). When this input is provided, the events will be collected from the beginning of time to this date. If no hour is provided, the date will default to '00:00:00' Use '""'. (two double-quotes) if you do not wish to filter by 'ToDate'

To date

Get event log

Full path of the output file in the local machine

Output file

Windows 10 x86/x64 (1803/1809/1903) - Windows 7 x64 (Multi-language)

Returns the number of events that occurred in the last n minutes, categorized by event severity.\nUseful for having an overview on the presence of meaningful events in a given time frame.

Number of minutes indicating the time frame under analysis. Allowed values are from 0 to 2628000 (5 years)

Threshold in minutes

The Provider Name registered with the event log as source of entries. Use '""' (two double-quotes) if you do not wish to use Event Log provider

The ID used to define the uniquely identifiable events that a Windows computer can encounter. Use '""' (two double-quotes) if you do not wish to filter on the Event ID

Get number of log events

Number of events with severity "Information" that occurred in the specified time frame

Number of information

Number of events with severity "Warning" that occurred in the specified time frame

Number of warning

Number of events with severity "Error" that occurred in the specified time frame

Number of error

Number of events with severity "Critical" that occurred in the specified time frame

Number of critical

This Remote Action can be used to interrogate the Windows Event Log and output details of any matching event found according to the event information provided in the inputs of the Remote Action. \n\nThe Remote Action is particularly useful for Nexthink Flow scenarios whereby you wish to understand if an event took place on a device, and then take a certain branch within the Flow. The Remote Action can of course be used in a data collection use case just like other Remote Actions.\n\nSupported Platforms: Windows

The script should be executed every 30 minutes.

Number of minutes to recurse the event log to find the error details provided (valid inputs are 30 minutes to 10080 minutes - the latter which is equal to 1 week/10080 minutes)

Search time period last x minutes

This can be an Application, Security, System or a custom log name such as Microsoft-Windows-Diagnostics-Performance/Operational

Event log 1

The severity level associated to the entries in the event log. The accepted values are Information, warning, error, critical

Severity_level 1

The ID used to define the uniquely identifiable events that a Windows computer can encounter. This field should be one integer value

Event Id 1

The event log description that you wish to do a match on, if you use this input it will be included in the output calculation for boolean "event_found". In this case we will calculate based on a match in the supplied "event_log", "severity_level" , "event_id", and "event_description"

Event description 1

Event log 2

Severity_level 2

Event Id 2

Event description 2

Event log 3

Severity_level 3

Event Id 3

Event description 3

Event log 4

Severity_level 4

Event Id 4

Event description 4

Event log 5

Severity_level 5

Event Id 5

Event description 5

Get Windows Event Log entry information

Boolean value (true or false) of whether the event based on the inputs supplied was detected in the last execution, in the event that more than one match is found we will output the most recent match data

Event found 1

The ID of the event (with matching severity) that was found

The severity level of the event (with the matching ID) that was found

Event severity 1

The name of the event log in which the ID and severity was found

From the point that the Remote Action executed, the number of minutes that passed since the last matching entry provided was detected

Number of minutes since event logged 1

The description taken from the last event which was found (within the timeframe provided). In cases where the description is very long please note it may be truncated

Event Logs

Description

Versions

Content

Required Products

Platforms

Compatibility