#To define a particular parameter, replace the 'parameterName' inside itsm.getParameter('parameterName') with that parameter's name
event_exceed = 25   # Maximum events excced in the duretion time      
duration = 24         #Duration in hrs
import subprocess
import ctypes
from collections import Counter
import sys

def alert(arg):
    sys.stderr.write("%d%d%d" % (arg, arg, arg))
    
class disable_file_system_redirection:
    _disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection
    _revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection
    def __enter__(self):
        self.old_value = ctypes.c_long()
        self.success = self._disable(ctypes.byref(self.old_value))
    def __exit__(self, type, value, traceback):
        if self.success:
            self._revert(self.old_value)

def ecmd(ps_command):
    with disable_file_system_redirection():
        process=subprocess.Popen('powershell "%s"'%ps_command, shell=True, stdout=subprocess.PIPE)
    result=process.communicate()
    ret=process.returncode
    if ret==0:
        if result[0]:    
            return result[0].strip()
        else:
            return None
    
    else:   
        return '%s\n%s'%(str(ret), str(result[1]))


ps_command1=r'Get-EventLog -LogName "system" -EntryType "error" -After (Get-Date).AddHours(-%d) |Select-Object -Property EventId'%duration
data1 = ecmd(ps_command1)
ps_command2=r'Get-EventLog -LogName "system" -EntryType "warning" -After (Get-Date).AddHours(-%d) |Select-Object -Property EventId'%duration
data2 = ecmd(ps_command2)
ps_command3=r'Get-EventLog -LogName "application" -EntryType "error" -After (Get-Date).AddHours(-%d) |Select-Object -Property EventId'%duration
data3 = ecmd(ps_command3)
ps_command4=r'Get-EventLog -LogName "application" -EntryType "warning" -After (Get-Date).AddHours(-%d) |Select-Object -Property EventId'%duration
data4 = ecmd(ps_command4)
event_ids = []
if data1 != None:
    [event_ids.append(i) for i in data1.split('\r')[2:]]
if data2 != None:
    [event_ids.append(i) for i in data2.split('\r')[2:]]
if data3 != None:
    [event_ids.append(i) for i in data3.split('\r')[2:]]
if data4 != None:
    [event_ids.append(i) for i in data4.split('\r')[2:]]


data = dict(Counter(event_ids))
events_list = []
for a, b in data.items():
    if b > event_exceed:
        events_list.append(a)

if len(events_list) > 0:
    print "List of Events Exceed %s"%event_exceed
    print events_list
    alert(1)
else:
    alert(0)