Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

Powershell get-eventlog very time consuming

Posted on 2014-02-25
9
Medium Priority
?
590 Views
Last Modified: 2014-03-03
HI Guys,

When I try this code it takes ages!!, please help:

get-content C:\ADMS1_Servers.txt | foreach {Get-EventLog -computername $_ -LogName system -After 17/02/2014 | where {$_.eventid -eq "11"} } | select *

It takes so long that I've never seen it complete. PLease help!
0
Comment
Question by:Kay
  • 4
  • 3
  • 2
9 Comments
 
LVL 35

Expert Comment

by:Dan Craciun
ID: 39885632
How long does it take for a single server?
I mean if C:\ADMS1_Servers.txt contains a single server.
0
 

Author Comment

by:Kay
ID: 39885664
ive tried that, it takes forever, I just gave up in the end.
0
 
LVL 35

Expert Comment

by:Dan Craciun
ID: 39885700
OK. This:
Get-EventLog -LogName system -After 2/17/2014 | where {$_.eventid -eq "11"}

Open in new window

returned results after 1 second.

Make sure your locale is correct. On my system 17/02/2014 threw an error

HTH,
Dan
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 

Author Comment

by:Kay
ID: 39885823
that im sure is correct as our systems are on the UK format :)
0
 
LVL 72

Expert Comment

by:Qlemo
ID: 39885914
You might see an improvement if you allow Get-EventLog to manage the PCs itself, or use Get-WinEvent -FilterHashTable (which allows for filtering for an event id):
Get-EventLog -Computer (get-content C:\ADMS1_Servers.txt) -LogName system -After 17/02/2014 | where {$_.eventid -eq "11"} }  | ft * -auto
Get-WinEvent -Computer (get-content C:\ADMS1_Servers.txt)  -FilterHashTable @{
  logname = 'system'
  ID = 11
  StartTime = 17/02/2014
} | ft * -auto

Open in new window

(Dates in UK format of dd/mm/yyyy).
0
 

Author Comment

by:Kay
ID: 39888403
HI Qlemo,

The get-eventlog still takes very, I can't even cancel out of it by pressing cntrl + c.

The get-winevent doesn't work, its gives me this error message:

Get-WinEvent : Cannot convert 'System.Object[]' to the type 'System.String' required by parameter 'Co
fied method is not supported.
At line:1 char:23
+ Get-WinEvent -Computer <<<<  (get-content C:\ADMS1_Windows_Servers.txt)  -FilterHashTable @{
    + CategoryInfo          : InvalidArgument: (:) [Get-WinEvent], ParameterBindingException
    + FullyQualifiedErrorId : CannotConvertArgument,Microsoft.PowerShell.Commands.GetWinEventCommand

Thanks for your help :)
0
 
LVL 72

Expert Comment

by:Qlemo
ID: 39888564
Oh, that's true, Get-WinEvent does not allow for a string array for -ComputerName ...
get-content C:\ADMS1_Servers.txt | % {
  Get-WinEvent -Computer $_  -FilterHashTable @{
    logname = 'system'
    ID = 11
    StartTime = 17/02/2014
}} | ft * -auto

Open in new window

0
 

Author Comment

by:Kay
ID: 39892149
HI Guys,

I tried this code below:

Get-EventLog -Computer (get-content C:\ADMS1_Windows_Servers.txt) -LogName system -After 17/02/2014 | where {$_.eventid -match "7|11|51|52"}   | ft * -auto

Open in new window


However the -match gives me anything with a 7 or 11 e.g  00711 or 1231144? How can I get it to match only the number I've specified?

Also it takes ages, I let it running all night then when I came back tomorrow morning and it was still running, then I pressed cntrl + c , then it gave me some results.
0
 
LVL 72

Accepted Solution

by:
Qlemo earned 2000 total points
ID: 39892358
ft -auto requires to get all output collected before pushing to the screen, so that's the reason you see results not before collecting is stopped. You can see the results earlier if you remove the -auto.

I can't answer for the "for ages" part - it shouldn't. Get-EventLog isn't fast, but it should not run for hours ...

Instead of the match you should use -contains:
Get-EventLog -Computer (get-content C:\ADMS1_Windows_Servers.txt) -LogName system -After 17/02/2014 | where {7, 11, 51, 52 -contains $_.eventid}   | ft * -auto

Open in new window

0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently we ran in to an issue while running some SQL jobs where we were trying to process the cubes.  We got an error saying failure stating 'NT SERVICE\SQLSERVERAGENT does not have access to Analysis Services. So this is a way to automate that wit…
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
The viewer will learn how to create a basic form using some HTML5 and PHP for later processing. Set up your basic HTML file. Open your form tag and set the method and action attributes.: (CODE) Set up your first few inputs one for the name and …
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an anti-spam), the admin…
Suggested Courses

564 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question