8.13. Triggering an Action When an Event Occurs


You must be running Windows XP or Windows Server 2003 to use event triggers.


You want to kick off a program or script when a particular event occurs. For example, you may want to send yourself an email when the event occurs or write another event to the event log.


Using a graphical user interface

Event Viewer doesn't support creating triggers.

Using a command-line interface

Windows Server 2003 comes with a new tool called eventtriggers that allows you to configure event log triggers.

> eventtriggers /Create /TR "<TriggerName>" /L <LogName> /EID <EventID> /TK <Command>

For example:

> eventtriggers /Create /TR "Email Trigger" /L Application /EID 177 /TK "cscript 

To view the list of event log triggers configured on a server, run this command:

> eventtriggers /query /s <ServerName>

To delete a trigger with ID 1, run this command:

> eventtriggers /delete /s <ServerName> /TID 1

To get a list of configured triggers, run this command:

> eventtriggers /query /s <ServerName>

Using VBScript

See Recipe 8.14 for an example of how to monitor events as they occur via a script.


The eventtriggers utility is a powerful new tool that can run on a Windows XP or Windows Server 2003 computer and that runs a command when a specific event occurs. It has three main options for managing event triggers: /Create, /Delete, and /Query. Here is the syntax for the eventtriggers /Create option:

Parameter List: /S system Specifies ...

Get Windows Server Cookbook now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.