I have a quick question about powershell. If I write $event1 = Get-EventLog system | Where-Object {$_.EventID -eq 6006} | Select-Object -first 1 -Property Index it only displays the index. Which is right... But if I write $event1 = Get-EventLog system | Where-Object {$_.EventID -eq 6006} | Select-Object -first 1 -Property Time The time is not showing up... Just a blank row. What am I doing wrong. I fond nothing on the internet about that probem. So maybe you could help me. I am a beginner btw :)
As commented, there is no property called Time. Use TimeGenerated or TimeWritten instead.
$event1 = Get-EventLog System | Where-Object {$_.EventID -eq 6006} | Select-Object -First 1 -Property TimeGenerated
However, the docs say that
"Get-EventLog uses a Win32 API that is deprecated. The results may not be accurate. Use the Get-WinEvent cmdlet instead."
To change to Get-WinEvent the following gets you what you want:
$event1 = Get-WinEvent -LogName System | Where-Object {$_.Id -eq 6006} | Select-Object -First 1 -Property TimeCreated
Related
I am trying to write a powershell script to check all of the online computers and then make it one neat column Here is the code I have so far...
$computers = get-adcomputer -LDAPFilter "(Name=SDA000*)" | Select-Object -Property Name
$computers1 = get-adcomputer -LDAPFilter "(Name=SDA005*)" | Select-Object -Property Name
$computers2 = get-adcomputer -LDAPFilter "(Name=SDA006*)" | Select-Object -Property Name
$computers3 = get-adcomputer -LDAPFilter "(Name=SDA007*)" | Select-Object -Property Name
$computers4 = ($computers) + ($computers1) + ($computers2) + ($computers3)
[array]$online = #($computers4.Name | % {test-connection -erroraction silentlycontinue -Count 1 $_})
$wIw = $online | Select-Object Address
$wIw
But the output always leaves the top 3 lines with extraneous data I don't want. i.e
Address
-------
SDA0003
SDA0007
SDA000B
SDA000C
SDA0050
SDA0051
SDA0054
SDA0057
SDA005F
SDA0061
SDA006B
SDA006D
SDA0076
I can write it to a text file and then pipe it to select-object -skip 3, but that does not seem to work with a variable.
thanks for any advice.
What you are seeing is the header (e.g. the "Address" property). To output it to the screen without the header, you can use the -HideTableHeaders in a Format-Table command:
...
$wIw = $online | Select-Object Address
$wIw | Format-Table -HideTableHeaders
Ohh yes, that treat is sometimes quit helpful but most of the time it is in the way. Here is how I get rid of it:
$computers = (get-adcomputer -LDAPFilter "(Name=SDA000*)" | Select-Object -Property Name).name
Looks like what you want can be done easier like this:
$wIw = (Get-ADComputer -LDAPFilter "(Name=SDA00*)" |
Where-Object { ($_.Name | Test-Connection -Count 1 -Quiet -ErrorAction SilentlyContinue) }).Name
I am planning to extract the CPU details to my powershell requirement. Below is the highlighted parameter that I am trying to extract.
I have tried using Get-WmiObject Win32_Process or Get-Process but no luck with it. Can you guide with the cmdlet which can be helpful for this
Updated Question
Get-Counter '\Process(*)\% Processor Time' |
Select-Object -ExpandProperty countersamples |
Select-Object -Property instancename, cookedvalue|
Sort-Object -Property cookedvalue -Descending |
Select-Object| ft InstanceName,#{L='CPU';E={($_.Cookedvalue/100).toString('P')}} -AutoSize
I am using this code as suggested in the below comments. and below is the output which I am receiving.
However if you compare the value for PS output and the task manager screenshot, its quite different, since in task manager most of them are 0
Updated Part 2
I have extracted this code from another post.
$NumberOfLogicalProcessors=(Get-WmiObject -class Win32_processor | Measure-Object -Sum NumberOfLogicalProcessors).Sum
(Get-Counter '\Process(*)\% Processor Time').Countersamples | Sort cookedvalue -Desc | ft -a instancename, #{Name='CPU %';Expr={[Math]::Round($_.CookedValue / $NumberOfLogicalProcessors)}}
This may be working, but I would like to get your opinions on these since the value for this is dynamic and pretty difficult to verify
try this:
$Utilization = #()
Get-WmiObject Win32_PerfFormattedData_PerfProc_Process | Sort-Object -Property PercentProcessorTime -descending | ? { $_.name -inotmatch '_total|idle' } | % {$Utilization += [PSCustomObject]#{'Process Name' = $_.Name; 'pid' = $_.IDProcess; 'Usage' = $_.PercentProcessorTime}}
I am a beginner with PowerShell, How can know the usage of CPU of a windows service in an interval of time (for example for one hour) with PowerShell?
Something like this:
Get-Service | Get-counter
Thank so much
For CPU usage you need to use the get-process commandlet and then map the process name with the corresponding service.
Here is one of the past discussion thread where the get-process is discussed
Listing processes by CPU usage percentage in powershell
Sample code here
$Details = #()
$AllRunningServices = Get-CimInstance -class win32_service | Where-Object {$_.State -eq 'Running'} | Select-Object ProcessId , Name
foreach($procid in $AllRunningServices)
{
$Details += Get-Process | Where-Object {$_.Id -eq $procid.ProcessId} | Select-Object ProcessName, Id, CPU , #{Name = "serviceName" ; Expression={$procid.Name}}
}
$Details |Sort-Object -Property CPU -Descending | ft
If I run the following two commands at the same time only the first one displays. If I run them separately then I get both results. What am I missing?
Get-WmiObject win32_volume -Computername "Your Server Name" | select driveletter, BlockSize, FreeSpace
Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP' -recurse | Get-ItemProperty -name Version,Release -EA 0 | Where { $_.PSChildName -match '^(?!S)\p{L}' -and $_.Version -gt 3.5 -and $_.Version -lt 3.6} | Select PSChildName, Version, Release;
I've seen this before. You're confusing PowerShell's output table display. It's a bug with Select-Object, as far as I know. Here's some sample code:
"" | Select-Object -Property #{n="1";e={1}};
"" | Select-Object -Property #{n="2";e={2}};
"" | Select-Object -Property #{n="1";e={11}},#{n="2";e={22}};
Which outputs (whitespace condensed):
1
-
1
11
While this code:
"" | Select-Object -Property #{n="1";e={11}},#{n="2";e={22}};
"" | Select-Object -Property #{n="1";e={1}};
"" | Select-Object -Property #{n="2";e={2}};
Outputs this (whitespace condensed):
1 2
- -
11 22
1
2
Notice it's all in one table? It's like the first Select-Object determines the table's headers, and the rest have to follow suit. I don't know why it does it or if it's been fixed in PowerShell v5.0.
The easy workaround is to pipe to Format-Table:
"" | Select-Object -Property #{n="1";e={1}} | Format-Table -AutoSize;
"" | Select-Object -Property #{n="2";e={2}} | Format-Table -AutoSize;
"" | Select-Object -Property #{n="1";e={11}},#{n="2";e={22}} | Format-Table -AutoSize;
Which correctly outputs:
1
-
1
2
-
2
1 2
- -
11 22
I am extremely new to PowerShell I am trying to create a script that will look thought the system event log and pull out the items that match Error, Verbose , and Warnings; Then I want to export them to a CSV file.
I was able to get each of the variables created for the $errorlog, $verboselog, and $warninglog (shown below).
$errorlog = Get-EventLog system -Newest 200 | Where-Object {$_.entryType -Match 'Error'}
$verboselog = Get-EventLog system -Newest 200 | Where-Object {$_.entryType -Match 'Verbose'}
$warninglog = Get-EventLog system -Newest 200 | Where-Object {$_.entryType -Match 'Warning'}
When I go ahead and try export them to one CSV file it just displays the $errorlog. From what I have gather from various websites the command I am using should be working.
$errorlog,$verboselog,$waninglog | Export-CSV -inputobject -path 'C:\service\test.CSV'
It is tell me that is it missing '-inputobject' so I moved the variables around to look like the following.
Export-CSV -inputobject $errorlog,$verboselog,$warninglog -path 'C:\service\test.CSV'
It exported with out error but it didn't display the data I wanted in the file.
I thank you in advance for your help.
$errorlog = Get-EventLog system -Newest 200| Where-Object {$_.entryType -eq 'Error'}
$verboselog = Get-EventLog system -Newest 200| Where-Object {$_.entryType -eq 'Verbose'}
$warninglog = Get-EventLog system -Newest 200| Where-Object {$_.entryType -eq 'Warning'}
$errorlog+$verboselog+$warninglog | Export-Csv C:\service\test.CSV
I replaced the -match with -eq and dropped the inputobject switch. I also changed the commas to plus symbols to concantinate the results. This worked for me.