Power shell script searching log files

I have the following PS script that works except when something that is not a date is in the first field. I need to get by this error if anyone has any ideas on how to accomplish that.

$Date = (Get-Date -format yyyy-MM-dd)
ForEach($error in Get-Content C:\MonitorFolder\errorName.txt){
$error | % {
Select-String -path "C:\jboss-4.0.5.GA\server\default\log\server.log.2013-06-26" -Pattern $_ | where { (Get-Date((($_.Line).split("|")[0]).split(",")[0])) -gt (Get-Date).AddHours(-48) }
} | Out-File C:\MonitorFolder\ServerLogerrors.txt
$linesFound = (Get-Content C:\MonitorFolder\ErrorName.txt)
If ($linesFound.count -gt 0)
{Send-MailMessage -From 'Server_Log_Check@systrends.com' -To 'jimmy.lewis@systrends.com' `
  -SmtpServer 'smtp4.systrends.com' `
  -Subject $error' Testing  error Found on Border Reports server in server.log File (PS Script)' `
    -Body  @"
      Messages found in the last 30 minutes
      $(((Get-Content C:\MonitorFolder\Serverlogerrors.txt) | out-string) -join "`n")
"@
}}

The problem/exception occurs then the log file does not have the date as the first field.

2013-06-26 08:38:43,953 ERROR [STDERR]       at org.apache.tomcat.util.
2013-06-26 08:38:43,953 ERROR [STDERR]       at org.apache.tomcat.util.net.MasterSlav
2013-06-26 08:38:43,953 ERROR [STDERR]       at java.lang.Thread.run(Thread.java:619)
2013-06-26 08:38:43,953 ERROR [com.systrends.web.UserLogin] Password changing failed
javax.ejb.FinderException: java.sql.SQLException: No current row in the ResultSet.
      at com.systrends.postoffice.UsersEntityBean.ejbFindByLoginPassword(Unknown
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
      at

Throws the following error:

Get-Date : Cannot bind parameter 'Date'. Cannot convert value "javax.ejb.Finder
Exception: java.sql.SQLException: No current row in the ResultSet." to type "Sy
stem.DateTime". Error: "The string was not recognized as a valid DateTime. Ther
e is a unknown word starting at index 0."

It looks to me like the javax.ejb.FinderException being in the first row is causing the problem.

Any ideas on how to get around this problem?
LVL 1
jimmylew52Asked:
Who is Participating?
 
QlemoConnect With a Mentor Batchelor, Developer and EE Topic AdvisorCommented:
None of the errors in the errorName.txt are in the log file, so nothing can be found.
In addition, you won't find something like javax.ejb.FinderException, as that doesn't have the timestamp prefixed. The Select-String lists that, but the -match eliminates anything without a timestamp prefix.
0
 
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
Sorry, but that script is a mess :( This is the least necessary change:
$Date = (Get-Date -format yyyy-MM-dd)
ForEach ($error in Get-Content C:\MonitorFolder\errorName.txt){
  $error | % {
    (Select-String -path "C:\jboss-4.0.5.GA\server\default\log\server.log.2013-06-26" -Pattern $_ ) -match '^\d{4}-\d{2}-\d{2}' |
      where { (Get-Date((($_.Line).split("|")[0]).split(",")[0])) -gt (Get-Date).AddHours(-48) }
  } | Out-File C:\MonitorFolder\ServerLogerrors.txt
  $linesFound = (Get-Content C:\MonitorFolder\ServerLogerrors.txt)
  If ($linesFound.count -gt 0)
  {
    Send-MailMessage -From 'Server_Log_Check@systrends.com' -To 'jimmy.lewis@systrends.com' `
      -SmtpServer 'smtp4.systrends.com' `
      -Subject $error' Testing  error Found on Border Reports server in server.log File (PS Script)' `
      -Body  @"
      Messages found in the last 30 minutes
      $(((Get-Content C:\MonitorFolder\Serverlogerrors.txt) | out-string) -join "`n")
"@
}}

Open in new window

BTW, line 7 was wrong (looking for the count of errorName.txt instead of ServerLogerrors.txt).
But even that will send a separate mail for each error category of errorName.txt, which is certainly not what you want.
0
 
jimmylew52Author Commented:
I'm not supprised it is a mess. I am trying to learn this in my spare time, (not much of that).

Getting a different error:

You cannot call a method on a null-valued expression.
At C:\MonitorFolder\CheckServerLogFiles2.ps1:10 char:41
+       where { (Get-Date((($_.Line).split <<<< ("|")[0]).split(",")[0])) -gt (
Get-Date).AddHours(-48) }
    + CategoryInfo          : InvalidOperation: (split:String) [], RuntimeExce
   ption
    + FullyQualifiedErrorId : InvokeMethodOnNull
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
This one should be better:
$Date = (Get-Date -format yyyy-MM-dd)
ForEach ($error in Get-Content C:\MonitorFolder\errorName.txt)
{
  @(Select-String -path "C:\jboss-4.0.5.GA\server\default\log\server.log.2013-06-26" -Pattern $error) -match '^\d{4}-\d{2}-\d{2}' |
    where { (Get-Date $_.Line.split("|")[0].split(",")[0]) -gt (Get-Date).AddHours(-48) }
} | Out-File C:\MonitorFolder\ServerLogerrors.txt
$linesFound = Get-Content C:\MonitorFolder\ServerLogerrors.txt
If ($linesFound.count -gt 0)
{
  Send-MailMessage -From 'Server_Log_Check@systrends.com' -To 'jimmy.lewis@systrends.com' `
    -SmtpServer 'smtp4.systrends.com' `
    -Subject $error' Testing  error Found on Border Reports server in server.log File (PS Script)' `
    -Body  @"
      Messages found in the last 30 minutes
      $($linesFound -join "`n")
"@
}

Open in new window

0
 
jimmylew52Author Commented:
Not as many errors but still throwing an error.

An empty pipe element is not allowed.
At C:\MonitorFolder\CheckServerLogFiles2.ps1:11 char:4
+ } | <<<<  Out-File C:\MonitorFolder\ServerLogerrors.txt
    + CategoryInfo          : ParserError: (:) [], ParseException
    + FullyQualifiedErrorId : EmptyPipeElement


I  have not seen the empty pipe error before.
0
 
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
Ok, that's my fault. foreach does not output anything into a pipeline. Anyway, I wanted to get rid of that loop, to allow for scanning the log file in one pass only, and here you go:
$logfile = 'C:\jboss-4.0.5.GA\server\default\log\server.log.2013-06-26'

$Date = Get-Date -format yyyy-MM-dd
@(Select-String -Path $logfile -SimpleMatch -Pattern (Get-Content C:\MonitorFolder\errorName.txt)) `
  -match '^\d{4}-\d{2}-\d{2}' |
  where { (Get-Date $_.Line.split("|")[0].split(",")[0]) -gt (Get-Date).AddHours(-48) } |
  Tee-Object -Variable linesFound | Out-File C:\MonitorFolder\ServerLogerrors.txt
If ($linesFound.count -gt 0)
{
  Send-MailMessage -From 'Server_Log_Check@systrends.com' -To 'jimmy.lewis@systrends.com' `
    -SmtpServer 'smtp4.systrends.com' `
    -Subject $error' Testing  error Found on Border Reports server in server.log File (PS Script)' `
    -Body  @"
      Messages found in the last 30 minutes
      $($linesFound -join "`n")
"@
}

Open in new window

I'm not sure you still need the output file for anything. If not, assigning the result of the long select-string line to a var (only) is much better, e.g. with
@(Select-String -Path $logfile -SimpleMatch -Pattern (Get-Content C:\MonitorFolder\errorName.txt)) `
  -match '^\d{4}-\d{2}-\d{2}' |
  where { (Get-Date $_.Line.split("|")[0].split(",")[0]) -gt (Get-Date).AddHours(-48) } |
  set-variable linesfound

Open in new window

BTW, I have switched Select-String to SimpleMatch because I assume you will not use regular expressions in your search pattern file.
0
 
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
To elaborate on the empty pipe, try following examples:
foreach ($i in 1..3) { $i } 
foreach ($i in 1..3) { $i } | out-string
$(foreach ($i in 1..3) { $i }) | out-string

Open in new window

The latter builds a subexpression from foreach, and that always has a result. Somewhat strange, but important if you want to use IF, FOREACH and some other commands to return values instead of executing commands.
0
 
jimmylew52Author Commented:
I understand most of the changes but still have a problem.

No errors are thrown but the error line in errorname.txt, that do exist in the log file, are not emailed to me. You script well beyond my abilities to  troubleshoot.
0
 
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
Did you try both versions of my code?
Could you post a small example (as files) for a log file and the errorname.txt?
0
 
jimmylew52Author Commented:
Will get to this first thing this morning
0
 
jimmylew52Author Commented:
Tried both versions this morning. The second version runs without errors but it does not send the email when it finds the error string.

Uploaded the requested files. Sorry for the delay, it has been very busy this morning.
errorName.txt
server.log.2013-06-26.txt
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.