Hi all powershell gurus out there.
I have a foreach which opens a URL from URLListl.txt and doing a Measure-command on them. The result from Measure-command writes to event-log.
In another text file i have country list, like:
USA
Canada
Brazil
and so on....
I want in write eventlogs Message to read from this Text file and write it with the Measure-command result in Message part of the eventlog.
The below is my script which works fine but it creates two entries for each URL.
{
$URLListFile = "C:\yourname\URLList.txt"
$URLList = Get-Content $URLListFile -ErrorAction SilentlyContinue
Foreach ($Uri in $URLList)
{
$Time = Measure-Command {
C:\yourname\MainScript.ps1}
$Time.TotalSeconds
$countrycode = (Get-Content c:\yourname\URLListcountry.txt)
foreach ($SiteCode in $CountryCode)
{
$LogFileExist = Get-EventLog -list | Where-Object { $_.LogDisplayName -eq "Scriptcheck" }
if (! $LogFileExist)
{
New-EventLog -LogName "Scriptcheck" -Source "Scripts"
}
if ($Time.Totalseconds -lt 25)
{
Write-EventLog -LogName "Scriptcheck" -Source "Scripts" -EntryType information -EventId 100 -Message " $SiteCode `nTotal Time: $Time"
}
elseif ($Time.Totalseconds -gt 25)
{
Write-EventLog -LogName "Scriptcheck" -Source "Scripts" -EntryType warning -EventId 101 -Message " $SiteCode `nTotal Time: $Time"
}
}
}
}
if (Get-Process -name iexplore -ErrorAction SilentlyContinue)
{
Stop-Process -Name iexplore
}
Measure-Site
Related
I have the following block in script that checks a log file and if it finds a specific line, should continue.
$keywords=Get-Content "C:\Users\user\desktop\keywords.txt"
Get-Content "C:\Users\user\desktop\some.log" -tail 1 -wait |
ForEach-object {
foreach($word in $keywords) {
if($_ -match "$word") {
Write-EventLog -LogName Application -EventID 2001 -EntryType Information -Source serviceCheck -Message "[SUCCESS] The service has been initialized"
Write-Host "[SUCCESS] The service has been initialized"
}
}
} | Select -First 1
This logs the event but never continues with the rest of the script.
If I put some other command in if($_ -match "$word") {get-date} for example or anything else, it works and continues to the next command.
How should this be made to write in event viewer and continue?
You need to output something for the Select -First 1 statement to react to:
$keywords = Get-Content "C:\Users\user\desktop\keywords.txt"
Get-Content "C:\Users\user\desktop\some.log" -tail 1 -wait |ForEach-object {
foreach ($word in $keywords) {
if ($_ -match "$word") {
Write-EventLog -LogName Application -EventID 2001 -EntryType Information -Source serviceCheck -Message "[SUCCESS] The service has been initialized"
Write-Host "[SUCCESS] The service has been initialized"
"literally any value will do!"
}
}
} | Select -First 1 |Out-Null
I have a log file that needs to keep monitored that file looking for some keywords, I created a PowerShell script and used the get-content command with the -wait flag but, get-content is just reading the first keyword, and If I remove -wait it will work fine and read all keywords, but it will exit after finished, and I want the file to keep waiting for the appended lines.
Please advise me on this.
This is my code:
$date = Get-date -Format "yyyyMMdd"
$MyError = #('error 1', 'error 2', 'error 3')
$file=$date.log"
foreach ($i in $MyError) {
Get-Content "$file" -Wait | Select-String -Pattern $i -SimpleMatch | ForEach-Object {
if ($i -like 'error 1') {
Write-EventLog -source Test -LogName Test -EventId 1001 -EntryType Error -Message " "
}
if ($i -like 'error 2') {
Write-EventLog -source Test -LogName Test -EventId 1002 -EntryType Error -Message " "
}
if ($i -like 'error 3') {
Write-EventLog -source Test -LogName Test -EventId 1003 -EntryType Error -Message " "
}
}
}
The issue with your code is that -Wait blocks the main thread, waits indefinitely until CTRL+C. Because of this, your outer foreach loops only once, so $i is always error 1. An easy fix for your problem is to loop inside the ForEach-Object, but also, using a switch -Wildcard would simplify your code:
Get-Content path\to\file.txt -Wait | ForEach-Object {
switch -Wildcard ($_) {
'*error 1*' {
# do something for error 1
}
'*error 2*' {
# do something for error 2
}
'*error 3*' {
# do something for error 3
}
}
}
I have written a small function that writes into a single logfile for each server this module is installed, but somehow a few cycles to write the line are lost, sometime I get the error file already in use. I have tested this function on different version of Powershell, PS5.1, PS6, PS7.1 x86 and x64 all with the same result.
if (!(Test-Path -ErrorAction Stop -Path (Join-path -Path $ScriptLogPath -ChildPath "$FQDN.log"))) {
New-Item -Path $ScriptLogPath -Name "$FQDN.log" -Force -ItemType File -ErrorAction Stop
}
$CreatedNew = $false
$Global:MTX = New-Object -TypeName System.Threading.Mutex($true, 'Global\LogFileMutex', [ref]$CreatedNew)
try {
if (-not $CreatedNew) {
$Global:MTX.WaitOne(10000) | Out-Null
}
}
catch [System.Threading.AbandonedMutexException] {
if (!(Test-Path -Path 'HKLM:\System\CurrentControlSet\services\eventlog\Application\LogWriter')) {
New-EventLog -LogName Application -Source LogWriter
}
Write-EventLog -LogName "Application" -Source "LogWriter" -EntryType Error -Message $_.Exception -EventId 1000
}
($Date + $InstanceId + $Severity + $ScriptLineNumber + $ScriptName + $Message) | Out-File -Append -FilePath (Join-path -Path $ScriptLogPath -ChildPath "$FQDN.log")
}
catch {
if (!(Test-Path -Path 'HKLM:\System\CurrentControlSet\services\eventlog\Application\LogWriter')) {
New-EventLog -LogName Application -Source LogWriter
}
Write-EventLog -LogName "Application" -Source "LogWriter" -EntryType Error -Message $_.Exception -EventId 1000
}
finally {
if ($Null -ne $Global:MTX) {
[void]$Global:MTX.ReleaseMutex()
[void]$Global:MTX.Dispose()
}
}
That is the block of code that will append the formatted string into the file.
So fare I have tried different approaches to handle the Mutex, made them globally and not. Used different approaches to append the string to the file, like Add-Content.
To try out the function I use this little script, it should write 150 lines, but end up with about 130 and no single error.
for ($num1 = 1 ; $num1 -le 5 ; $num1++) {
Start-Job {
for ($num = 1 ; $num -le 10 ; $num++) {
Write-Log -Severity 'INFO' -Message "Starting Job $num"
Start-Job -ScriptBlock {
try {
Start-Sleep -Milliseconds (Get-Random -Maximum 10)
Write-Log -Severity 'INFO' -Message "Starting"
Start-Sleep -Milliseconds (Get-Random -Maximum 10)
Write-Log -Severity 'INFO' -Message "DONE"
}
catch {
New-Item -Path "C:\Users\User\Desktop" -Name (Get-Date -Format "dd/MM/yyyy HH:mm:ss") -ItemType File
}
}
}
}
Since every server is writing to the same logfile, i dont think that you can override "error file already in use"
Iam thinking that maby you should think over the concept and run from a server where you are monitoring by invoke-commmand ?
Hello I am trying to add -or operator to my Script to avoid and infinite script run using a counter but I don´t get that works, if I don´t use -or over while It´s work ok but if I add the program script, run infinite
Import-Module WebAdministration
$server = "server1"
$evtsrc = "AppPool Resurrector"
$loopcounter = 0
if ( [System.Diagnostics.EventLog]::SourceExists($evtsrc) -eq $false){
New-EventLog -LogName Application -Source $evtsrc
}
while((Get-ChildItem IIS:\AppPools | where {$_.state -eq "Stopped"}).count -gt 0 -or ($loopcounter -lt 20))
{
$appPools = Get-ChildItem -Path 'IIS:\AppPools' | where {$_.state -eq "Stopped"} | Foreach-Object {$_.Name}
foreach ($appPoolName in $appPools) {
Start-WebAppPool $appPoolName
Write-Host ($appPoolName)
Start-Sleep -Seconds 10
$loopcounter++
if ((Get-WebAppPoolState -Name $appPoolName).Value -eq "Started"){
Write-EventLog -LogName Application -Message "Start Application Pool `"$appPoolName`" because SMB Client is connected again." -Source $evtsrc -EntryType Warning -EventId 666 -Category 0
}
else{
write-Host ("test")
}
}
}
You should use -and instead of -or here, like Mathias R. Jessen already commented.
Also, I would suggest using Splatting the arguments for the Write-EventLog cmdlet to make the code more readable and easier to maintain.
Something like below:
$loopcounter = 0
$appPools = Get-ChildItem -Path 'IIS:\AppPools' | Where-Object {$_.State -eq "Stopped"}
# as long as there are stopped app pools AND we have not yet reached the max for the loop counter
while ($appPools.Count -gt 0 -and ($loopcounter -lt 20)) {
$appPools | Foreach-Object {
$appPoolName = $_.Name
Write-Host "Starting '$appPoolName'"
Start-WebAppPool $appPoolName
Start-Sleep -Seconds 10 # that's a mighty long wait..
$loopcounter++
if ((Get-WebAppPoolState -Name $appPoolName).Value -eq 'Started') {
$splat = #{
'LogName' = 'Application'
'Message' = "Start Application Pool '$appPoolName' because SMB Client is connected again."
'Source' = $evtsrc
'EntryType' = 'Warning'
'EventId' = 666
'Category' = 0
}
Write-EventLog #splat
}
else{
write-Host ("test: Counter = $loopcounter")
}
}
# refresh the app pools variable
$appPools = Get-ChildItem -Path 'IIS:\AppPools' | Where-Object {$_.State -eq "Stopped"}
}
Hope that helps
Playing around with the Get-EventLog command. The first 3 commands work as expected.
Get-EventLog Application -Newest 1000 | Select Message
Get-EventLog System -Newest 1000 | Select Message
Get-EventLog Security -Newest 1000 | Select Message
But this does not work
Get-EventLog Setup -Newest 1000 | Select Message
and this does not work
Get-EventLog setup
How come? There are WSUS errors in the Setup that we'd like to capture.
Sorry this is a bit long but I'm kind of fond of try/catch statements and over-communication.
#requires -Version 2.0
function RemoteEventLog([Parameter(Mandatory=$true)]$LogName, $MaxEvents,[Parameter(Mandatory = $true)]$computers, $LogPath)
{
<#
.SYNOPSIS
Gather remote event logs by log name by computer names.
.DESCRIPTION
Specifiy a log name to narrow down the search. Provide as many computernames as needed.
.PARAMETER maxevents
-maxevents is all about how many events.
.PARAMETER computers
The array or list of comma separated computer names to run the script through.
.PARAMETER LogPath
-LogPath will let you decide the parent folder of the location to store the logs by computer name.
.EXAMPLE
RemoteEventLog -logname Application -maxevents 1000 -computers ('host1','host2','host3')
This will loop through the computers and bring back the log for each computer.
#>
$computers = $computers -split (',')
try
{
$testLogPath = Test-Path $LogPath
}
catch
{
"Error was $_"
$line0 = $_.InvocationInfo.ScriptLineNumber
"Error was in Line $line0"
}
if(!($testLogPath))
{
try
{
New-Item -Path $LogPath -ItemType Directory -ErrorAction:Stop
}
catch
{
"Error was $_"
$line1 = $_.InvocationInfo.ScriptLineNumber
"Error was in Line $line1"
}
}
foreach($computer in $computers)
{
try
{
$log = Get-WinEvent -LogName $logName -MaxEvents $maxevents -ComputerName $computer -ErrorAction:Stop
}
catch
{
"Error was $_"
$line2 = $_.InvocationInfo.ScriptLineNumber
"Error was in Line $line2"
}
try
{
New-Item -Path $LogPath -Name ("$computer.evt") -Value $log -Force
$log | Out-File -FilePath $LogPath
}
catch
{
"Error was $_"
$line3 = $_.InvocationInfo.ScriptLineNumber
('Error was in Line {0}' -f $line3)
}
}
}
RemoteEventLog -logname Application -MaxEvents 100 -computers 'localhost,computer2,computer3' -LogPath D:\Desktop\logs