How to listen for windows events?

[LoganAC34]

Hi! I'm new to Node-RED and transitioning from EventGhost. I'm trying to rebuild some scripts I had in EventGhost in Node-RED, but I can't figure out a way to listen for windows events. I searched the forum, but couldn't find anything about windows events. EventGhost had native support for listening to events, but it doesn't look like Node-RED does. Could anyone point me in a direction to look into or have any solutions? Not sure if it helps at all, but I can code in Python.

Thanks in advance!

[Steve-Mcl]

If you want to get windows event log entries, you can use powershell (either as a script you call using exec node or by installing a powershell node)

Example:

Get-EventLog -LogName System -Newest 5 |  ConvertTo-Json

inject -> exec -> JSON node

[LoganAC34]

I'm assuming then i would need this to be looping constantly, searching for the event I want to react to?

[Steve-Mcl]

That is one way. How quickly do you need to be receiving and reacting to the events?

There are other routes. for example, you could write a c# deamon program that uses EventLogTraceListener Class (System.Diagnostics) | Microsoft Learn, listens for your specific event, then sends it to node-red via MQTT/HTTP/other

Or you could try adding windows-event-reader - npm to the setup tab on a function node & see if that works. (see this article for using modules in a function node)

Depending on how instantaneous you need this will likely determine your path.

[LoganAC34]

I would like it to react in less than 5 seconds, but the faster the better.

I was just thinking of something similar but with Python since that's what I'm familiar with. I started working on a solution that used Windows Task Scheduler, but couldn't figure out how to get the data from Python to Node-RED. Do you have any recommendations on on how to go about using MQTT/HTTP/other? I'm not familiar with anything.

I'll look into everything as well and see what I can do.

Thanks!

[Steve-Mcl]

I usually recommend that you learn Node/JavaScript (you obviously have programming ability, so why not expand that?)

If 5 secs is ok then I see no real hardship in simply running a powershell every 5 secs and checking for new events.

however, if you want to do this in python, then MQTT is probably the way to go. Your python app would run contineoulsy (a deamon) and would send events, as they occur to node-red using MQTT (that would be my first choice).

MQTT is VERY easy to understand and use - it will be worth learning.
node-red mqtt for beginners

[LoganAC34]

I'm always up for learning new things, so i'll get into those eventually. Just trying to get things running for now. I'll have to tinker from here to see what I can do and how everything works.

Thanks for the help and the info. You given me a direction to research into. I'm currently looking into windows-event-reader and it looks like its working in the function node, i just don't know how to use it or the function node lol, so i'm going to keep digging into that and see if I can figure it out.

Thanks again!

[steff]

I use the software Restriction Policies in Windows 10, to show me the last warning regarding the last file to run, I also use the Task Scheduler.

For the event log you can select via filters at what should be triggered. On a hit, a Powershell script is then triggered, which copies the path of the file to the clipboard and sends it to an mqtt topic for further processing.

Script:

$A = Get-EventLog -LogName Application -EntryType Warning -Newest 1
$B = $A | Select-Object -Property *
$B -match "([A-Z]\:\\.+)(?=')"
$message = $Matches[0]
& 'C:\Program Files\mosquitto\mosquitto_pub.exe' -h 192.168.178.32 -p 1883 -u <user> -P <password> -t 'EventLog/SRP_Warnings' -m "$message"
$message | clip

In this case, Home Assistant will send a notification to the desktop.

[krambriw]

Nice to see you here Logan!
You are in the right place, so many helpful and skilled people aroud here, I'm sure you will reach your targets. Myself, I have so many re-used Python scripts from the good old EventGhost days, using MQTT to communicate with Node-RED. If you need some ideas, just reach out

Here is a typical setup I use in all my Node-RED instances. I let Node-RED start and monitor the running of my scripts. I really want to be sure they are working as expected. If they should fail, I let Node-RED restart them (and inform me about it via Telegram). In all scripts I therefore have a heartbeat feature, expecting the scripts to respond within a certain time. Might look a bit complex but is really straight forward