Solved

Power shell script searching log files

Posted on 2013-06-27
11
436 Views
Last Modified: 2013-07-01
I have the following PS script that works except when something that is not a date is in the first field. I need to get by this error if anyone has any ideas on how to accomplish that.

$Date = (Get-Date -format yyyy-MM-dd)
ForEach($error in Get-Content C:\MonitorFolder\errorName.txt){
$error | % {
Select-String -path "C:\jboss-4.0.5.GA\server\default\log\server.log.2013-06-26" -Pattern $_ | where { (Get-Date((($_.Line).split("|")[0]).split(",")[0])) -gt (Get-Date).AddHours(-48) }
} | Out-File C:\MonitorFolder\ServerLogerrors.txt
$linesFound = (Get-Content C:\MonitorFolder\ErrorName.txt)
If ($linesFound.count -gt 0)
{Send-MailMessage -From 'Server_Log_Check@systrends.com' -To 'jimmy.lewis@systrends.com' `
  -SmtpServer 'smtp4.systrends.com' `
  -Subject $error' Testing  error Found on Border Reports server in server.log File (PS Script)' `
    -Body  @"
      Messages found in the last 30 minutes
      $(((Get-Content C:\MonitorFolder\Serverlogerrors.txt) | out-string) -join "`n")
"@
}}

The problem/exception occurs then the log file does not have the date as the first field.

2013-06-26 08:38:43,953 ERROR [STDERR]       at org.apache.tomcat.util.
2013-06-26 08:38:43,953 ERROR [STDERR]       at org.apache.tomcat.util.net.MasterSlav
2013-06-26 08:38:43,953 ERROR [STDERR]       at java.lang.Thread.run(Thread.java:619)
2013-06-26 08:38:43,953 ERROR [com.systrends.web.UserLogin] Password changing failed
javax.ejb.FinderException: java.sql.SQLException: No current row in the ResultSet.
      at com.systrends.postoffice.UsersEntityBean.ejbFindByLoginPassword(Unknown
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
      at

Throws the following error:

Get-Date : Cannot bind parameter 'Date'. Cannot convert value "javax.ejb.Finder
Exception: java.sql.SQLException: No current row in the ResultSet." to type "Sy
stem.DateTime". Error: "The string was not recognized as a valid DateTime. Ther
e is a unknown word starting at index 0."

It looks to me like the javax.ejb.FinderException being in the first row is causing the problem.

Any ideas on how to get around this problem?
0
Comment
Question by:jimmylew52
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 5
11 Comments
 
LVL 70

Expert Comment

by:Qlemo
ID: 39282272
Sorry, but that script is a mess :( This is the least necessary change:
$Date = (Get-Date -format yyyy-MM-dd)
ForEach ($error in Get-Content C:\MonitorFolder\errorName.txt){
  $error | % {
    (Select-String -path "C:\jboss-4.0.5.GA\server\default\log\server.log.2013-06-26" -Pattern $_ ) -match '^\d{4}-\d{2}-\d{2}' |
      where { (Get-Date((($_.Line).split("|")[0]).split(",")[0])) -gt (Get-Date).AddHours(-48) }
  } | Out-File C:\MonitorFolder\ServerLogerrors.txt
  $linesFound = (Get-Content C:\MonitorFolder\ServerLogerrors.txt)
  If ($linesFound.count -gt 0)
  {
    Send-MailMessage -From 'Server_Log_Check@systrends.com' -To 'jimmy.lewis@systrends.com' `
      -SmtpServer 'smtp4.systrends.com' `
      -Subject $error' Testing  error Found on Border Reports server in server.log File (PS Script)' `
      -Body  @"
      Messages found in the last 30 minutes
      $(((Get-Content C:\MonitorFolder\Serverlogerrors.txt) | out-string) -join "`n")
"@
}}

Open in new window

BTW, line 7 was wrong (looking for the count of errorName.txt instead of ServerLogerrors.txt).
But even that will send a separate mail for each error category of errorName.txt, which is certainly not what you want.
0
 
LVL 1

Author Comment

by:jimmylew52
ID: 39282313
I'm not supprised it is a mess. I am trying to learn this in my spare time, (not much of that).

Getting a different error:

You cannot call a method on a null-valued expression.
At C:\MonitorFolder\CheckServerLogFiles2.ps1:10 char:41
+       where { (Get-Date((($_.Line).split <<<< ("|")[0]).split(",")[0])) -gt (
Get-Date).AddHours(-48) }
    + CategoryInfo          : InvalidOperation: (split:String) [], RuntimeExce
   ption
    + FullyQualifiedErrorId : InvokeMethodOnNull
0
 
LVL 70

Expert Comment

by:Qlemo
ID: 39282320
This one should be better:
$Date = (Get-Date -format yyyy-MM-dd)
ForEach ($error in Get-Content C:\MonitorFolder\errorName.txt)
{
  @(Select-String -path "C:\jboss-4.0.5.GA\server\default\log\server.log.2013-06-26" -Pattern $error) -match '^\d{4}-\d{2}-\d{2}' |
    where { (Get-Date $_.Line.split("|")[0].split(",")[0]) -gt (Get-Date).AddHours(-48) }
} | Out-File C:\MonitorFolder\ServerLogerrors.txt
$linesFound = Get-Content C:\MonitorFolder\ServerLogerrors.txt
If ($linesFound.count -gt 0)
{
  Send-MailMessage -From 'Server_Log_Check@systrends.com' -To 'jimmy.lewis@systrends.com' `
    -SmtpServer 'smtp4.systrends.com' `
    -Subject $error' Testing  error Found on Border Reports server in server.log File (PS Script)' `
    -Body  @"
      Messages found in the last 30 minutes
      $($linesFound -join "`n")
"@
}

Open in new window

0
Free eBook: Backup on AWS

Everything you need to know about backup and disaster recovery with AWS, for FREE!

 
LVL 1

Author Comment

by:jimmylew52
ID: 39282349
Not as many errors but still throwing an error.

An empty pipe element is not allowed.
At C:\MonitorFolder\CheckServerLogFiles2.ps1:11 char:4
+ } | <<<<  Out-File C:\MonitorFolder\ServerLogerrors.txt
    + CategoryInfo          : ParserError: (:) [], ParseException
    + FullyQualifiedErrorId : EmptyPipeElement


I  have not seen the empty pipe error before.
0
 
LVL 70

Expert Comment

by:Qlemo
ID: 39282402
Ok, that's my fault. foreach does not output anything into a pipeline. Anyway, I wanted to get rid of that loop, to allow for scanning the log file in one pass only, and here you go:
$logfile = 'C:\jboss-4.0.5.GA\server\default\log\server.log.2013-06-26'

$Date = Get-Date -format yyyy-MM-dd
@(Select-String -Path $logfile -SimpleMatch -Pattern (Get-Content C:\MonitorFolder\errorName.txt)) `
  -match '^\d{4}-\d{2}-\d{2}' |
  where { (Get-Date $_.Line.split("|")[0].split(",")[0]) -gt (Get-Date).AddHours(-48) } |
  Tee-Object -Variable linesFound | Out-File C:\MonitorFolder\ServerLogerrors.txt
If ($linesFound.count -gt 0)
{
  Send-MailMessage -From 'Server_Log_Check@systrends.com' -To 'jimmy.lewis@systrends.com' `
    -SmtpServer 'smtp4.systrends.com' `
    -Subject $error' Testing  error Found on Border Reports server in server.log File (PS Script)' `
    -Body  @"
      Messages found in the last 30 minutes
      $($linesFound -join "`n")
"@
}

Open in new window

I'm not sure you still need the output file for anything. If not, assigning the result of the long select-string line to a var (only) is much better, e.g. with
@(Select-String -Path $logfile -SimpleMatch -Pattern (Get-Content C:\MonitorFolder\errorName.txt)) `
  -match '^\d{4}-\d{2}-\d{2}' |
  where { (Get-Date $_.Line.split("|")[0].split(",")[0]) -gt (Get-Date).AddHours(-48) } |
  set-variable linesfound

Open in new window

BTW, I have switched Select-String to SimpleMatch because I assume you will not use regular expressions in your search pattern file.
0
 
LVL 70

Expert Comment

by:Qlemo
ID: 39282417
To elaborate on the empty pipe, try following examples:
foreach ($i in 1..3) { $i } 
foreach ($i in 1..3) { $i } | out-string
$(foreach ($i in 1..3) { $i }) | out-string

Open in new window

The latter builds a subexpression from foreach, and that always has a result. Somewhat strange, but important if you want to use IF, FOREACH and some other commands to return values instead of executing commands.
0
 
LVL 1

Author Comment

by:jimmylew52
ID: 39282449
I understand most of the changes but still have a problem.

No errors are thrown but the error line in errorname.txt, that do exist in the log file, are not emailed to me. You script well beyond my abilities to  troubleshoot.
0
 
LVL 70

Expert Comment

by:Qlemo
ID: 39283588
Did you try both versions of my code?
Could you post a small example (as files) for a log file and the errorname.txt?
0
 
LVL 1

Author Comment

by:jimmylew52
ID: 39284042
Will get to this first thing this morning
0
 
LVL 1

Author Comment

by:jimmylew52
ID: 39285331
Tried both versions this morning. The second version runs without errors but it does not send the email when it finds the error string.

Uploaded the requested files. Sorry for the delay, it has been very busy this morning.
errorName.txt
server.log.2013-06-26.txt
0
 
LVL 70

Accepted Solution

by:
Qlemo earned 500 total points
ID: 39286842
None of the errors in the errorName.txt are in the log file, so nothing can be found.
In addition, you won't find something like javax.ejb.FinderException, as that doesn't have the timestamp prefixed. The Select-String lists that, but the -match eliminates anything without a timestamp prefix.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In previous parts of this Nano Server deployment series, we learned how to create, deploy and configure Nano Server as a Hyper-V host. In this part, we will look for a clustering option. We will create a Hyper-V cluster of 3 Nano Server host nodes w…
Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
In a recent question (https://www.experts-exchange.com/questions/29004105/Run-AutoHotkey-script-directly-from-Notepad.html) here at Experts Exchange, a member asked how to run an AutoHotkey script (.AHK) directly from Notepad++ (aka NPP). This video…

695 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question