VBScript: Check for Low Disk Space and Report to Event Viewer

This code is part of a bigger project I'm working on. It checks the disk space for each logical drive and, if the space is below one gigabyte, reports it to Event Viewer at a max of once per day.

'**************************************************************************** ' This script created by Chrissy LeMaire ([email protected]) ' Website: https://netnerds.net/ ' ' NO WARRANTIES, etc. ' ' This script checks hard drives for less than 1GB of space. ' ' Requirements -- ability to read WinNT://, create events and read WMI ' ' This script has only been tested on Windows Server 2003. ' ' "What it does" ' 1. Gets a list of computers on a domain ' 2. Checks for disk space ' 3. If disk space < 1 GB, add to Event Viewer but not more than once a day. '*****************************************************************************

On Error Resume Next 'Ignore errors

Set objAdRootDSE = GetObject("LDAP://RootDSE") Set objRS = CreateObject("adodb.recordset")

varConfigNC = objAdRootDSE.Get("defaultNamingContext") strConnstring = "Provider=ADsDSOObject" strWQL = "SELECT * FROM 'LDAP://" & varConfigNC & "' WHERE objectCategory= 'Computer' and OperatingSystem = 'Windows*Server*'" objRS.Open strWQL, strConnstring Do until objRS.eof Set objServer = GetObject(objRS.Fields.Item(0)) strServerName = objServer.CN Call GetDiskSpaceAddEvent(strServerName) objRS.movenext Set objServer = Nothing Loop objRS.close

Set objRS = Nothing Set objAdRootDSE = Nothing

'----------------------------------------------------------------------- ' ' Do the Dirty Work ' '-----------------------------------------------------------------------

Sub GetDiskSpaceAddEvent(strComputer) myDate = date2String(strComputer,"-24")

Set objWMIService = GetObject("winmgmts:" & strComputer & "\root\cimv2") Set colItems = objWMIService.ExecQuery ("Select DeviceID, FreeSpace from Win32_LogicalDisk where DriveType = 3") 'Grab the name and the free space for fixed drives

For Each objItem in colItems MBFree = formatnumber((objItem.FreeSpace/1048576),2) If MBFree > 1000 Then 'Convert to MB then check for < 1GB theQuery = "SELECT * FROM Win32_NTLogEvent WHERE Eventcode = '1000' and Type = 'Error' and LogFile='System' and SourceName = 'Low Disk Space' and TimeWritten >= '" & myDate & "' and Message like '%" & objItem.DeviceID & "%" & strComputer & "%'"

Set colLoggedEvents = objWMIService.ExecQuery (theQuery) If colLoggedEvents.Count = 0 Then runThis = "%COMSPEC% /c eventcreate /s " & strComputer & " /so ""Low Disk Space"" /T Error /ID 1000 /L System /D ""The size of disk " & objItem.DeviceID & " on " & StrComputer & " has dropped below 1 Gigabyte (" & MBFree & " MB free).""" WindowStyle = 0 'Do not pop up a dos box Set WshShell = WScript.CreateObject("WScript.Shell") 'generate the object Call WshShell.Run (runThis, WindowStyle, false) 'execute the dos command listed above (COMSPEC = cmd.exe) Set WshShell = Nothing End If Set colLoggedEvents = Nothing End If Next

End Sub

'----------------------------------------------------------------------- ' ' Supporting Date Functions to convert WMI date to human readable dates ' '-----------------------------------------------------------------------

'The function listed below only works in 2k3 and XP. So we use the manual ones below. 'Function date2WMI(theHourDiff) 'Set WMIDate = CreateObject("WbemScripting.SWbemDateTime") 'WMIDate.SetVarDate DateAdd("hh", theHourDiff, Now()) 'Date2WMI = WMIDate.Value 'End Function

Function string2Date(dtmInstallDate) WMIDateStringToDate = CDate(Mid(dtmInstallDate, 5, 2) & "/" & _ Mid(dtmInstallDate, 7, 2) & "/" & Left(dtmInstallDate, 4) _ & " " & Mid (dtmInstallDate, 9, 2) & ":" & _ Mid(dtmInstallDate, 11, 2) & ":" & Mid(dtmInstallDate, _ 13, 2)) string2Date = WMIDateStringToDate End Function

Function date2String(strComputer,theOffset) Set objSWbemServices = GetObject("winmgmts:\.\root\cimv2") Set colTimeZone = objSWbemServices.ExecQuery ("SELECT * FROM Win32_TimeZone") For Each objTimeZone in colTimeZone strBias = objTimeZone.Bias Next

dtmCurrentDate = date + theOffset 'response.write dtmCurrentDate dtmTargetDate = Year(dtmCurrentDate)

dtmMonth = Month(dtmCurrentDate) If Len(dtmMonth) = 1 Then dtmMonth = "0" & dtmMonth End If

dtmTargetDate = dtmTargetDate & dtmMonth

dtmDay = Day(dtmCurrentDate) If Len(dtmDay) = 1 Then dtmDay = "0" & dtmDay End If

dtmTargetDate = dtmTargetDate & dtmDay & "000000.000000" dtmTargetDate = dtmTargetDate & Cstr(strBias)

date2String = dtmTargetDate End Function

WScript.Quit