Solved

Power shell script searching log files

Posted on 2013-06-27
11
433 Views
Last Modified: 2013-07-01
I have the following PS script that works except when something that is not a date is in the first field. I need to get by this error if anyone has any ideas on how to accomplish that.

$Date = (Get-Date -format yyyy-MM-dd)
ForEach($error in Get-Content C:\MonitorFolder\errorName.txt){
$error | % {
Select-String -path "C:\jboss-4.0.5.GA\server\default\log\server.log.2013-06-26" -Pattern $_ | where { (Get-Date((($_.Line).split("|")[0]).split(",")[0])) -gt (Get-Date).AddHours(-48) }
} | Out-File C:\MonitorFolder\ServerLogerrors.txt
$linesFound = (Get-Content C:\MonitorFolder\ErrorName.txt)
If ($linesFound.count -gt 0)
{Send-MailMessage -From 'Server_Log_Check@systrends.com' -To 'jimmy.lewis@systrends.com' `
  -SmtpServer 'smtp4.systrends.com' `
  -Subject $error' Testing  error Found on Border Reports server in server.log File (PS Script)' `
    -Body  @"
      Messages found in the last 30 minutes
      $(((Get-Content C:\MonitorFolder\Serverlogerrors.txt) | out-string) -join "`n")
"@
}}

The problem/exception occurs then the log file does not have the date as the first field.

2013-06-26 08:38:43,953 ERROR [STDERR]       at org.apache.tomcat.util.
2013-06-26 08:38:43,953 ERROR [STDERR]       at org.apache.tomcat.util.net.MasterSlav
2013-06-26 08:38:43,953 ERROR [STDERR]       at java.lang.Thread.run(Thread.java:619)
2013-06-26 08:38:43,953 ERROR [com.systrends.web.UserLogin] Password changing failed
javax.ejb.FinderException: java.sql.SQLException: No current row in the ResultSet.
      at com.systrends.postoffice.UsersEntityBean.ejbFindByLoginPassword(Unknown
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
      at

Throws the following error:

Get-Date : Cannot bind parameter 'Date'. Cannot convert value "javax.ejb.Finder
Exception: java.sql.SQLException: No current row in the ResultSet." to type "Sy
stem.DateTime". Error: "The string was not recognized as a valid DateTime. Ther
e is a unknown word starting at index 0."

It looks to me like the javax.ejb.FinderException being in the first row is causing the problem.

Any ideas on how to get around this problem?
0
Comment
Question by:jimmylew52
  • 6
  • 5
11 Comments
 
LVL 69

Expert Comment

by:Qlemo
ID: 39282272
Sorry, but that script is a mess :( This is the least necessary change:
$Date = (Get-Date -format yyyy-MM-dd)
ForEach ($error in Get-Content C:\MonitorFolder\errorName.txt){
  $error | % {
    (Select-String -path "C:\jboss-4.0.5.GA\server\default\log\server.log.2013-06-26" -Pattern $_ ) -match '^\d{4}-\d{2}-\d{2}' |
      where { (Get-Date((($_.Line).split("|")[0]).split(",")[0])) -gt (Get-Date).AddHours(-48) }
  } | Out-File C:\MonitorFolder\ServerLogerrors.txt
  $linesFound = (Get-Content C:\MonitorFolder\ServerLogerrors.txt)
  If ($linesFound.count -gt 0)
  {
    Send-MailMessage -From 'Server_Log_Check@systrends.com' -To 'jimmy.lewis@systrends.com' `
      -SmtpServer 'smtp4.systrends.com' `
      -Subject $error' Testing  error Found on Border Reports server in server.log File (PS Script)' `
      -Body  @"
      Messages found in the last 30 minutes
      $(((Get-Content C:\MonitorFolder\Serverlogerrors.txt) | out-string) -join "`n")
"@
}}

Open in new window

BTW, line 7 was wrong (looking for the count of errorName.txt instead of ServerLogerrors.txt).
But even that will send a separate mail for each error category of errorName.txt, which is certainly not what you want.
0
 
LVL 1

Author Comment

by:jimmylew52
ID: 39282313
I'm not supprised it is a mess. I am trying to learn this in my spare time, (not much of that).

Getting a different error:

You cannot call a method on a null-valued expression.
At C:\MonitorFolder\CheckServerLogFiles2.ps1:10 char:41
+       where { (Get-Date((($_.Line).split <<<< ("|")[0]).split(",")[0])) -gt (
Get-Date).AddHours(-48) }
    + CategoryInfo          : InvalidOperation: (split:String) [], RuntimeExce
   ption
    + FullyQualifiedErrorId : InvokeMethodOnNull
0
 
LVL 69

Expert Comment

by:Qlemo
ID: 39282320
This one should be better:
$Date = (Get-Date -format yyyy-MM-dd)
ForEach ($error in Get-Content C:\MonitorFolder\errorName.txt)
{
  @(Select-String -path "C:\jboss-4.0.5.GA\server\default\log\server.log.2013-06-26" -Pattern $error) -match '^\d{4}-\d{2}-\d{2}' |
    where { (Get-Date $_.Line.split("|")[0].split(",")[0]) -gt (Get-Date).AddHours(-48) }
} | Out-File C:\MonitorFolder\ServerLogerrors.txt
$linesFound = Get-Content C:\MonitorFolder\ServerLogerrors.txt
If ($linesFound.count -gt 0)
{
  Send-MailMessage -From 'Server_Log_Check@systrends.com' -To 'jimmy.lewis@systrends.com' `
    -SmtpServer 'smtp4.systrends.com' `
    -Subject $error' Testing  error Found on Border Reports server in server.log File (PS Script)' `
    -Body  @"
      Messages found in the last 30 minutes
      $($linesFound -join "`n")
"@
}

Open in new window

0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 
LVL 1

Author Comment

by:jimmylew52
ID: 39282349
Not as many errors but still throwing an error.

An empty pipe element is not allowed.
At C:\MonitorFolder\CheckServerLogFiles2.ps1:11 char:4
+ } | <<<<  Out-File C:\MonitorFolder\ServerLogerrors.txt
    + CategoryInfo          : ParserError: (:) [], ParseException
    + FullyQualifiedErrorId : EmptyPipeElement


I  have not seen the empty pipe error before.
0
 
LVL 69

Expert Comment

by:Qlemo
ID: 39282402
Ok, that's my fault. foreach does not output anything into a pipeline. Anyway, I wanted to get rid of that loop, to allow for scanning the log file in one pass only, and here you go:
$logfile = 'C:\jboss-4.0.5.GA\server\default\log\server.log.2013-06-26'

$Date = Get-Date -format yyyy-MM-dd
@(Select-String -Path $logfile -SimpleMatch -Pattern (Get-Content C:\MonitorFolder\errorName.txt)) `
  -match '^\d{4}-\d{2}-\d{2}' |
  where { (Get-Date $_.Line.split("|")[0].split(",")[0]) -gt (Get-Date).AddHours(-48) } |
  Tee-Object -Variable linesFound | Out-File C:\MonitorFolder\ServerLogerrors.txt
If ($linesFound.count -gt 0)
{
  Send-MailMessage -From 'Server_Log_Check@systrends.com' -To 'jimmy.lewis@systrends.com' `
    -SmtpServer 'smtp4.systrends.com' `
    -Subject $error' Testing  error Found on Border Reports server in server.log File (PS Script)' `
    -Body  @"
      Messages found in the last 30 minutes
      $($linesFound -join "`n")
"@
}

Open in new window

I'm not sure you still need the output file for anything. If not, assigning the result of the long select-string line to a var (only) is much better, e.g. with
@(Select-String -Path $logfile -SimpleMatch -Pattern (Get-Content C:\MonitorFolder\errorName.txt)) `
  -match '^\d{4}-\d{2}-\d{2}' |
  where { (Get-Date $_.Line.split("|")[0].split(",")[0]) -gt (Get-Date).AddHours(-48) } |
  set-variable linesfound

Open in new window

BTW, I have switched Select-String to SimpleMatch because I assume you will not use regular expressions in your search pattern file.
0
 
LVL 69

Expert Comment

by:Qlemo
ID: 39282417
To elaborate on the empty pipe, try following examples:
foreach ($i in 1..3) { $i } 
foreach ($i in 1..3) { $i } | out-string
$(foreach ($i in 1..3) { $i }) | out-string

Open in new window

The latter builds a subexpression from foreach, and that always has a result. Somewhat strange, but important if you want to use IF, FOREACH and some other commands to return values instead of executing commands.
0
 
LVL 1

Author Comment

by:jimmylew52
ID: 39282449
I understand most of the changes but still have a problem.

No errors are thrown but the error line in errorname.txt, that do exist in the log file, are not emailed to me. You script well beyond my abilities to  troubleshoot.
0
 
LVL 69

Expert Comment

by:Qlemo
ID: 39283588
Did you try both versions of my code?
Could you post a small example (as files) for a log file and the errorname.txt?
0
 
LVL 1

Author Comment

by:jimmylew52
ID: 39284042
Will get to this first thing this morning
0
 
LVL 1

Author Comment

by:jimmylew52
ID: 39285331
Tried both versions this morning. The second version runs without errors but it does not send the email when it finds the error string.

Uploaded the requested files. Sorry for the delay, it has been very busy this morning.
errorName.txt
server.log.2013-06-26.txt
0
 
LVL 69

Accepted Solution

by:
Qlemo earned 500 total points
ID: 39286842
None of the errors in the errorName.txt are in the log file, so nothing can be found.
In addition, you won't find something like javax.ejb.FinderException, as that doesn't have the timestamp prefixed. The Select-String lists that, but the -match eliminates anything without a timestamp prefix.
0

Featured Post

NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Create and license users in Office 365 in bulk based on a CSV file. A step-by-step guide with PowerShell script examples.
This article explains how to prepare an HTML email signature template file containing dynamic placeholders for users' Azure AD data. Furthermore, it explains how to use this file to remotely set up a department-wide email signature policy in Office …
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now