Log Server and outputting certain messages to a script

[sanjayhiranisq]

Hi,
I cant figure out a way for logserver to kick off a script everytime it gets a certain message. I have tried alert and execute script but that just gives alert text output and not the actual incoming message. Specifically I am after login/logout events from windows endpoints and send them to a script that will add to a database.

Please guide me through please.

[scottwilkerson]

This isn't directly possible with the alerts because some queries could have hundreds of thousands of events.

This best I could suggest at this time would be to pass the timestamp through to the script and you would have to use the API to re-call the query you are looking for.

[cdienger]

I confirmed the behavior and would need to file a feature request in order to be able to send more details in a script. In the meantime perhaps you could use the email alert option. The email alerts cant include details of an event with the %lastalertlog% %last10alertlogs% macros.