使用Powershell或SSIS将EventViewer错误日志导入到SQL Server表中

Question

Is there is any way to import the error logs from event viewer to SQL table and schedule a job on daily basis. I would like to use a powershell script or SSIS package.

Answer 1

First you could easily find answer on the web, but as I wanted to try this too, here is tested result.

Create table

You can make something like this:

CREATE TABLE WinLogs (
    EntryType VARCHAR(255),
    [Source] VARCHAR(255),
    [Message] VARCHAR(4000),
    TimeGenerated datetime
)

Create package

• Add Data Flow task to package;

• Inside package add Script Component , where you should add 4 output columns (arrows show what to change):

  EntryType (string 255)
  Source (string 255)
  Message (string 4000)
  TimeGenerated (database timestamp)

• Add below code to this component:

public override void CreateNewOutputRows()
{
    // Get all events from the Application(/System/Security) log from the local server (.)
    EventLog myEvenLog = new EventLog("Application", ".");

    // Create variable to store the entry
    EventLogEntry myEntry;

    // Loop trough all entries (oldest first)
    for (int i = 0; i < myEvenLog.Entries.Count; i++)
    {
        // Get single entry
        myEntry = myEvenLog.Entries[i];

        // Add new records
        this.Output0Buffer.AddRow();

        // Fill columns
        this.Output0Buffer.EntryType = myEntry.EntryType.ToString();
        this.Output0Buffer.Source = myEntry.Source;
        this.Output0Buffer.TimeGenerated = myEntry.TimeGenerated;
        // Take a max of 4000 chars
        this.Output0Buffer.Message = myEntry.Message.Substring(0, (myEntry.Message.Length > 4000 ? 3999 : myEntry.Message.Length - 1));
    }
}

• And the last step is to add SQL Server Destination component (also can be OLE DB Destination )
• Create Connection manager and select table where to insert data (look if mapping is correct).

• Run this package and you will see that data are inserted.

The source is from this example Eventlog as a source