• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 971
  • Last Modified:

PowerSehll 3.0 Parse Event Logs

Hi everyone,

I have been searching for a PowerShell script that searched the Description part of the event log in the system logs.  Therefore, if the description mentions 'fatal' but the event id were different, hence the need to search the description.

If anyone can assist very much grateful.

Thanks
0
CaussyR
Asked:
CaussyR
  • 4
  • 4
  • 4
  • +2
3 Solutions
 
David Paris VicenteSystems and Comunications  Administrator Commented:
Something like this?

$a = get-winevent -path [path to evt] -oldest nnn |
  where-object {$_.message -match "fatal"}
0
 
CaussyRAuthor Commented:
Rather than state the location of the evt file, I need this similar to the below, which at the moment is not working :

Get-WinEvent -computername RAJC -Logname Security -max 10 | Select ID,Level,Message | Where-Object { $_.Message | findstr /C:"stopped"}

I am trying to get to a script where I can enter the hostname and key word to find then PS will check the necessary event log but for starters just need to parse the event log...

Thanks for your reply.
0
 
Steven HarrisPresidentCommented:
What is the error received on your code?  Perhaps:

Get-WinEvent : Could not retrieve information about the Security log. Error: Attempted to perform an unauthorized
operation..
>

Now try this:

Get-WinEvent -computername RAJC -Logname Application -maxEvents 10 | 
Select ID,Level,Message | Where-Object { $_.Message | findstr /C:"stopped"}

Open in new window


What error do you get (if any)?
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
Don't use findstr here, that involves a lot of overhead.
For local events, filtering at client side is ok, or if you only parse a few records:
Get-WinEvent -LogName System | ? { $_.Message -like '*stopped*' } | select ID, Level, Message

Open in new window

For remote logs you should try to create a filter XML via the EventLog viewer, and use that filter string in Get-WinEvent -FilterXML, to allow for filtering on the remote machine.
0
 
CaussyRAuthor Commented:
I tried the above but get-winevent didn't bring back any message data.  Get-eventlog does bring back the message data.  I would prefer to use get-winevent as this works a lot faster.
0
 
Vaseem MohammedCommented:
If I understood the question, you are trying to find events which contains spcific word i.e., fatal.
and it doesn't matters which event ID it is.

Try something like this.

Get-EventLog -LogName Application -Newest 10 | where{$_.Message -match "fatal"}
0
 
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
Get-WinEvent doesn't return any data?
0
 
Vaseem MohammedCommented:
Get-WinEvent -LogName system -MaxEvents 10 | where{$_.message -match "fatal"}
0
 
CaussyRAuthor Commented:
So, when I run just : get-winevent -LogName System  -MaxEvents 10 the Message data is not displayed.

Therefore, I think I need to use the invoke-command to run get-eventlog.
0
 
Vaseem MohammedCommented:
are you trying to get result from remote computer? is remote management enabled on computer/s?
where exactly you are running the cmdlets? if the powershell console running as an "Administrator"
0
 
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
 (get-winevent -LogName System  -MaxEvents 10).Count
should display 10. If it doesn't, something is wrong. You are executing that on Vista or above?
0
 
Steven HarrisPresidentCommented:
Are you by chance running this from a file and missing errors from the console?
0
 
CaussyRAuthor Commented:
I am running Windows 7 Enterprise as an Administrator and I have tried running the query as a Domain Admin. I have enabled $PSRemoting on each server and when using  (get-winevent -LogName System  -MaxEvents 10).Count only returns the number 10 as expected and I did substitute .count to .message which also did not work.
0
 
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
PS3 allows that usuage of @(some collection).objectproperty, but PS2 does not. W7 by default uses PS2. That is the only possible reason I can find. If I'm correct,
 get-winevent System -max 10 | select message
returns something.
0
 
Vaseem MohammedCommented:
since you are trying to retrieve logs from remote computer you need to provide the name of computer in -ComputerName Parameter.

For one server use
Get-WinEvent -ComputerName <your srv name> -LogName system -MaxEvents 10

Open in new window

Replace <your srv name> with the name of server
once your get some data then use to filter
Get-WinEvent -ComputerName <your srv name> -LogName system -MaxEvents 10 | where{$_.message -match "fatal"} 

Open in new window

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

  • 4
  • 4
  • 4
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now