Logparser error when used with PowerShell - powershell

I'm trying to use Log Parser within PowerShell to export a Windows Evtx log file to CSV:
$logparser = "c:\program files (x86)\Log Parser 2.2\logparser.exe"
$allArgs = ("SELECT * INTO c:\logs\logs.csv FROM c:\logs\logs.evtx", "-i:evt", "-o:csv")
$ps = Start-Process -FilePath $logparser -ArguementList $allArgs -Wait -Passthru -NoNewWindow;
$ps.WaitForExit()
$ps.ExitCode;
But when I run this I get an error:
Error: detected extra argument "*" after query
The error code is 13. I tried putting the paths in single quotes and running it from the same directory as the logs but it keeps returning the same error.

You need to preserve the double quotes around the query string, otherwise it won't be recognized as a single argument by the spawned process.
Putting the query string (with double quotes) in single quotes might work:
$allArgs = '"SELECT * INTO c:\logs\logs.csv FROM c:\logs\logs.evtx"',
"-i:evt",
"-o:csv"
However, a much simpler solution to the problem would be to avoid Start-Process entirely and use the call operator (&) instead:
$logparser = "c:\program files (x86)\Log Parser 2.2\logparser.exe"
$query = "SELECT * INTO c:\logs\logs.csv FROM c:\logs\logs.evtx"
& $logparser -i:evt -o:csv $query

Related

Jenkinsfile with powershell. Need help dealing with quotes, triple-double-quotes and escaping characters

Good day,
I've been struggling for a while dealing with triple-double-quotes, triple-single-quotes, escaping quotes...
I need to execute a Powershell command with quotes in it.
There is what I have:
testsDll = powershell(returnStdout: true, script: '((Get-ChildItem -Path $env:WORKSPACE\\src\\Web\\*Unit.Tests.dll -Recurse) -join " ")').trim()
TestDllWithParameters = "$testsDll" + " /TestAdapterPath:" + "${env.WORKSPACE}" + "\\src\\Web\\packages\\NUnit3TestAdapter.3.16.1 /Logger:trx;LogFileName=Web123456.trx /TestCaseFilter:TestCategory!=DEADLOCK^&TestCategory!=QUARANTINE^&TestCategory!=Quarantine^&TestCategory!=NotImplemented^&TestCategory!=InProgress^&TestCategory!=INTEGRATION^&TestCategory!=Integration"
VSCodeExeFullPath = "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\Common7\IDE\Extensions\TestPlatform\vstest.console.exe"
env.VSTESTEXITCODE_WEB = powershell(returnStatus: true, script: """
Start-Process "$VSCodeExeFullPath" -ArgumentList "$TestDllWithParameters" -NoNewWindow
""")'
Variable interpolation works. The problem I have is that I would like to keep the quotes around both $VSCodeExeFullPath and $TestDllWithParameters since both contains spaces.
Thank you!

PowerShell variable to batch issue [duplicate]

I'm trying to use Log Parser within PowerShell to export a Windows Evtx log file to CSV:
$logparser = "c:\program files (x86)\Log Parser 2.2\logparser.exe"
$allArgs = ("SELECT * INTO c:\logs\logs.csv FROM c:\logs\logs.evtx", "-i:evt", "-o:csv")
$ps = Start-Process -FilePath $logparser -ArguementList $allArgs -Wait -Passthru -NoNewWindow;
$ps.WaitForExit()
$ps.ExitCode;
But when I run this I get an error:
Error: detected extra argument "*" after query
The error code is 13. I tried putting the paths in single quotes and running it from the same directory as the logs but it keeps returning the same error.
You need to preserve the double quotes around the query string, otherwise it won't be recognized as a single argument by the spawned process.
Putting the query string (with double quotes) in single quotes might work:
$allArgs = '"SELECT * INTO c:\logs\logs.csv FROM c:\logs\logs.evtx"',
"-i:evt",
"-o:csv"
However, a much simpler solution to the problem would be to avoid Start-Process entirely and use the call operator (&) instead:
$logparser = "c:\program files (x86)\Log Parser 2.2\logparser.exe"
$query = "SELECT * INTO c:\logs\logs.csv FROM c:\logs\logs.evtx"
& $logparser -i:evt -o:csv $query

How to correctly escape spaces and backslashes in command line arguments?

I had some issues passing an array of strings to a command in PowerShell, so I'm debugging my script. I'm using the EchoArgs.exe program found in the PowerShell Community Extension Project (PSCX).
If I execute this script:
Import-Module Pscx
cls
$thisOne = 'this_one\';
$secondOne = 'second one\';
$lastOne = 'last_one'
$args = $thisOne `
, "the $secondOne" `
, "the_$lastOne"
EchoArgs $args
I get this result:
Arg 0 is <this_one\>
Arg 1 is <the second one" the_last_one>
Command line:
"C:\Program Files (x86)\PowerShell Community Extensions\Pscx3\Pscx\Apps\EchoArgs.exe" this_one\ "the second one\" the_last_one
It seems that if a string contains spaces, the last backslash escapes the double quote. In fact all seems working if I escape only that backslash:
Import-Module Pscx
cls
$thisOne = 'this_one\';
$secondOne = 'second one\\';
$lastOne = 'last_one'
$args = $thisOne `
, "the $secondOne" `
, "the_$lastOne"
EchoArgs $args
with this result:
Arg 0 is <this_one\>
Arg 1 is <the second one\>
Arg 2 is <the_last_one>
Command line:
"C:\Program Files (x86)\PowerShell Community Extensions\Pscx3\Pscx\Apps\EchoArgs.exe" this_one\ "the second one\\" the_last_one
Is there a "smart" way in PowerShell (i.e. a cmdlet) to escape any string in order to avoid such issues?
Try using Start-Process instead. It has an $Arguments parameter that would suit this better.
See here: PowerShell - Start-Process and Cmdline Switches

Script not running at powershell

I have this snippet of code
$actDate=Get-Date -Format 'yyyy-MM-dd'
Start-job -name "FMLE" -command { cmd.exe /c 'c:\Program Files (x86)\Adobe\Flash Media Live Encoder 3.2\FMLEcmd.exe' /p C:\tasks\testing_2\testing 2_$actDate.xml /ap username:password /ab username:password /l C:\Users\acruz\AppData\Local\Temp\temp.log }
I know for sure, that the var $actDate is not being replaced at the line, how shuld I do that?
My two questions are: how to replace the $actDate for its value and how to save the result of the job to one log
Thanks for your help
EDIT
This does not works either:
$actDate = (Get-Date -Format 'yyyy-MM-dd')
$Args = ("/p C:\tasks\testing_2\testing 2_$actDate.xml","/ap username:password", "/ab uysername:password", "/l C:\Users\acruz\AppData\Local\Temp\temp.log")
$Args
$j = Start-job -name "FMLE" -ScriptBlock { & 'c:\Program Files (x86)\Adobe\Flash Media Live Encoder 3.2\FMLEcmd.exe' #args } -ArgumentList $args
Get-Job $j.Id
Receive-Job -Job $j | Out-File 'C:\Users\acruz\AppData\Local\Temp\temp.log' -encoding ASCII -append -force
Although $Args has the right information...
For your first question, you need to include the path using double quotes. A suggestion if you can then remove the space in the testing 2
"C:\tasks\testing_2\testing2_$actDate.xml"
To log result of the job use Receive-Job cmdlet.
One more try:
Try to put all paths in double quotes and then surround everything with a single quote after the cmd.exe /c part as shown below. Try to achieve something simpler with a simple task and then try to add complexity
$job = Start-Job -name "Hel" -Command { cmd.exe /c '"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" /?'}
I was able to make it work by doing it like this:
Start-job -Verbose -ScriptBlock {
$actDate = Get-Date -Format yyyy-MM-dd
cd "c:\Program Files (x86)\Adobe\Flash Media Live Encoder 3.2\"
.\FMLEcmd.exe /p "C:\site.com.mx\tasks\test_23445678\test 23445678_$actDate.xml" /ap user:password /ab user:password /l C:\site.com.mx\task.log
}
By doing it with -command it does not work, cause it does not replace the variable at all. Also, if I do it with -ArgumentList either was replacing the variable $actDate, so I though that may be by adding the whole script within the block it was work... and indeed, it did it...
So I don't know why it does not works, but this is a fix for me.

Executing an exe with arguments using Powershell

This is what I want to execute:
c:\Program Files (x86)\SEQUEL ViewPoint\viewpoint.exe /Setvar((POSTSTR $POSTSTR)(POSTEND $POSTEND)) /G:C:\viewpointfile.vpt /D:C:($BEGDATE to $TODDATE).xls
This is what I have tried:
$a = "/Setvar((POSTSTR $POSTSTR)(POSTEND $POSTEND))"
$b = "/G:C:\viewpointfile.vpt"
$c = "/D:C:($BEGDATE to $TODDATE).xls"
$Viewpoint = "c:\Program Files (x86)\SEQUEL ViewPoint\viewpoint.exe"
&$Viewpoint $a $b $c
When I execute this I receive an error stating:
File C:\viewpointfile.vpt "/D:C:($BEGDATE to $TODDATE).xls" not found!
I'm not sure where it gets the extra quotes from. If I run the command with just $a and $b it runs fine.
Any help would be greatly appreciated. Thanks! :)
Update
manojlds suggested echoargs so here it the output from it:
&./echoargs.exe $viewpoint $a $b $c
Arg 0 is C:\Program Files (x86)\SEQUEL ViewPoint\viewpoint.exe
Arg 1 is /Setvar((POSTSTR 20101123)(POSTEND 20111123))
Arg 2 is /G:C:\viewpointfile.vpt
Arg 3 is /D:C:(2010-11-23 to 2011-11-23 PM).xls
It appears that all the arguments are being passed properly. When I run this as a command in cmd.exe it executes perfectly. So something on Powershells end must be messing up the output.
Is there any other way to go about executing this command using Powershell?
I've found the method blogged by Joel Bennett to be the most reliable when calling legacy commands
http://huddledmasses.org/the-problem-with-calling-legacy-or-native-apps-from-powershell/
I've had to use this when calling LogParser from Powershell:
set-alias logparser "C:\Program Files (x86)\Log Parser 2.2\LogParser.exe"
start-process -NoNewWindow -FilePath logparser -ArgumentList #"
"SELECT * INTO diskspaceLP FROM C:\Users\Public\diskspace.csv" -i:CSV -o:SQL -server:"Win7boot\sql1" -database:hsg -driver:"SQL Server" -createTable:ON
"#
Get echoargs.exe from Powershell community extension ( http://pscx.codeplex.com/ ) to figure out the arguments that Powershell sends to your exe.
$a = "/Setvar((POSTSTR $POSTSTR)(POSTEND $POSTEND))"
$b = "/G:C:\viewpointfile.vpt"
$c = "/D:C:($BEGDATE to $TODDATE).xls"
$echoArgs = ".\echoargs.exe"
&$echoArgs $a $b $c
You seem to be passing the arguments fine however, but the viewpoint.exe seems to be acting up. I don't see what you are doing here:
$c = "/D:C:($BEGDATE to $TODDATE).xls"
After C: there is no \ and also your error message that you have pasted shows $BEGDATE and $TODDATE verbatim, which is not possible as they would have been substituted with their values.
If I can't run a command like this it usually works for me with Invoke-Expression. Can't test yours though.
Invoke-Expression "$viewpoint $a $b $c"