tim laqua dot com Thoughts and Code from Tim Laqua

Const HKLM = &H80000002
Set arrRunningCounterLogs = CreateObject( "System.Collections.ArrayList" )
Set arrStoppedCounterLogs = CreateObject( "System.Collections.ArrayList" )
Set dictCounterLogs = CreateObject( "Scripting.Dictionary" )
 
' ================= START Configuration Settings

strComputer = "."
arrCounterLogExclusionList = Array("System Overview","PerfWiz")
strExchangeServer = "smtpServer"
strScriptEmailIdentity = """PerfMonMon.vbs"" <tim@timlaqua.com>"
strLogStartEmailRecipients = "tim@timlaqua.com"
 
' ================= END Configuration Settings

strBasePath ="SYSTEM\CurrentControlSet\Services\SysmonLog\Log Queries"
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _ 
    strComputer & "\root\default:StdRegProv")
 
oReg.EnumKey HKLM, strBasePath, arrSubKeys
For Each subkey In arrSubKeys
	strLogKeyPath = strBasePath & "\" & subkey
	oReg.GetStringValue HKLM, strLogKeyPath, "Collection Name", strCollectionName
 
	If Not InArray(strCollectionName, arrCounterLogExclusionList) Then
		dictCounterLogs.Add strCollectionName, strLogKeyPath
		If IsLogRunning(strCollectionName) Then
			arrRunningCounterLogs.Add(strCollectionName)
		Else
			arrStoppedCounterLogs.Add(strCollectionName)
		End If
	End If
Next
 
If arrStoppedCounterLogs.Count > 0 Then
	Set oShell = WScript.CreateObject("WScript.Shell")
	boolErrors = False
 
	For Each strCounterLog in arrStoppedCounterLogs
		oShell.Run "logman start """ & strCounterLog & """ -s " & strComputer, 0, True
 
		If IsLogRunning(strCounterLog) Then
			strMessage = strMessage & "  " & strCounterLog & _
						 " was stopped - started log at " & Now & vbCrLf
		Else
			strMessage = strMessage & _
						 "  ERROR: Unable to start " & strCounterLog & vbCrLf
			boolErrors = True
		End If
	Next
 
	If boolErrors Then
		strSubject = "Stopped Counter Log Alert - Some counters could not be started"
	Else
		strSubject = "Stopped Counter Logs Detected - Counter Logs Started"
	End If
 
	SendEmail strExchangeServer, strScriptEmailIdentity, strLogStartEmailRecipients, strSubject, strMessage
End If
 
Function InArray(needle, haystack) 'As Boolean
	InArray = False
	For Each item In haystack
		If needle = item Then : InArray = True : Exit Function : End If
	Next
End Function
 
Function IsLogRunning(logName) 'As Boolean
	IsLogRunning = False
	oReg.GetDWORDValue HKLM, dictCounterLogs(logName), "Current State", dwCurrentState
	If dwCurrentState Then
		IsLogRunning = True
	End If
End Function
 
Sub SendEmail(server, sender, recipient, subject, textbody)
	Set objMessage = CreateObject("CDO.Message") 
	objMessage.Subject = subject 
	objMessage.From = sender 
	objMessage.To = recipient 
	objMessage.TextBody = textbody
 
	objMessage.Configuration.Fields.Item _
		("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2 
	objMessage.Configuration.Fields.Item _
		("http://schemas.microsoft.com/cdo/configuration/smtpserver") = server
	objMessage.Configuration.Fields.Item _
		("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25 
	objMessage.Configuration.Fields.Update
 
	objMessage.Send 
End Sub