cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
jperry
Engaged Sweeper III
Uses windows event log Microsoft-Windows-WER-SystemErrorReporting and code 1001

Select Distinct Top 1000000 tblAssets.AssetID,
tblAssets.AssetName,
tblADusers.Displayname,
tblAssets.OScode,
tblNtlog.Eventcode,
Max(tblNtlog.TimeGenerated) As LastOccurrence,
Count(tblNtlog.TimeGenerated) As Instances,
tblNtlogSource.Sourcename,
tblNtlogMessage.Message,
tblAssetCustom.Location,
tblAssets.Lastseen,
tblADusers.Username,
tblADusers.Userdomain,
tblAssetCustom.Model,
tblOperatingsystem.Version As [OS Version],
tblOperatingsystem.Caption As [OS Name],
tsysIPLocations.IPLocation,
tblAssets.Description As [LS Description],
tblADComputers.Description As [AD Description]
From tblAssets
Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID
Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
tblNtlog.SourcenameID
Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
Left Outer Join tblADusers On tblAssets.Username = tblADusers.Username
Left Outer Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Left Outer Join tsysAssetTypes On tsysAssetTypes.AssetType =
tblAssets.Assettype
Left Outer Join tblADComputers On tblAssets.AssetID = tblADComputers.AssetID
Left Outer Join tblOperatingsystem On tblAssets.AssetID =
tblOperatingsystem.AssetID
Left Outer Join tsysIPLocations On tsysIPLocations.LocationID =
tblAssets.LocationID
Where
tblNtlogSource.Sourcename Like '%Microsoft-Windows-WER-SystemErrorReporting%'
And tblNtlog.Eventcode = 1001 And tblNtlog.TimeGenerated > GetDate() - 3
Group By tblAssets.AssetID,
tblAssets.AssetName,
tblADusers.Displayname,
tblAssets.OScode,
tblNtlog.Eventcode,
tblNtlogSource.Sourcename,
tblNtlogMessage.Message,
tblAssetCustom.Location,
tblAssets.Lastseen,
tblADusers.Username,
tblADusers.Userdomain,
tblAssetCustom.Model,
tblOperatingsystem.Version,
tblOperatingsystem.Caption,
tsysIPLocations.IPLocation,
tblAssets.Description,
tblADComputers.Description,
tblADComputers.OU
Order By Count(tblNtlog.TimeGenerated) Desc,
LastOccurrence Desc,
tblAssets.AssetName
16 REPLIES 16
SAHarrington
Engaged Sweeper
I received the same error as laurentiun when trying to create the report.
Daniel_Red
Engaged Sweeper II
Hmm, I am not getting any hits, I think i might not be scanning that logfile. What exactly do I need to enable to collect this data?
harringg
Champion Sweeper
Thanks! Just had a customer ask me today if I knew why their PC went into BSOD. I'm now able to (quickly) tell them. 🙂
stevce_brazeau
Engaged Sweeper II
Very cool!
Yoginath
Engaged Sweeper
Great Efforts !! Thanks
jacob_bks
Champion Sweeper
Thanks - that's a really great report format!!

It works for me both in SQL Express and full MSSQL - not sure why you're getting an error?

laurentiun
Engaged Sweeper III
error:

There was an error parsing the query. [ Token line number = 1,Token line offset = 319,Token in error = Left ]

New to Lansweeper?

Try Lansweeper For Free

Experience Lansweeper with your own data.
Sign up now for a 14-day free trial.

Try Now