Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Powershell get-eventlog very time consuming

Posted on 2014-02-25
9
Medium Priority
?
536 Views
Last Modified: 2014-03-03
HI Guys,

When I try this code it takes ages!!, please help:

get-content C:\ADMS1_Servers.txt | foreach {Get-EventLog -computername $_ -LogName system -After 17/02/2014 | where {$_.eventid -eq "11"} } | select *

It takes so long that I've never seen it complete. PLease help!
0
Comment
Question by:Kay
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 2
9 Comments
 
LVL 35

Expert Comment

by:Dan Craciun
ID: 39885632
How long does it take for a single server?
I mean if C:\ADMS1_Servers.txt contains a single server.
0
 

Author Comment

by:Kay
ID: 39885664
ive tried that, it takes forever, I just gave up in the end.
0
 
LVL 35

Expert Comment

by:Dan Craciun
ID: 39885700
OK. This:
Get-EventLog -LogName system -After 2/17/2014 | where {$_.eventid -eq "11"}

Open in new window

returned results after 1 second.

Make sure your locale is correct. On my system 17/02/2014 threw an error

HTH,
Dan
0
 [eBook] Windows Nano Server

Download this FREE eBook and learn all you need to get started with Windows Nano Server, including deployment options, remote management
and troubleshooting tips and tricks

 

Author Comment

by:Kay
ID: 39885823
that im sure is correct as our systems are on the UK format :)
0
 
LVL 71

Expert Comment

by:Qlemo
ID: 39885914
You might see an improvement if you allow Get-EventLog to manage the PCs itself, or use Get-WinEvent -FilterHashTable (which allows for filtering for an event id):
Get-EventLog -Computer (get-content C:\ADMS1_Servers.txt) -LogName system -After 17/02/2014 | where {$_.eventid -eq "11"} }  | ft * -auto
Get-WinEvent -Computer (get-content C:\ADMS1_Servers.txt)  -FilterHashTable @{
  logname = 'system'
  ID = 11
  StartTime = 17/02/2014
} | ft * -auto

Open in new window

(Dates in UK format of dd/mm/yyyy).
0
 

Author Comment

by:Kay
ID: 39888403
HI Qlemo,

The get-eventlog still takes very, I can't even cancel out of it by pressing cntrl + c.

The get-winevent doesn't work, its gives me this error message:

Get-WinEvent : Cannot convert 'System.Object[]' to the type 'System.String' required by parameter 'Co
fied method is not supported.
At line:1 char:23
+ Get-WinEvent -Computer <<<<  (get-content C:\ADMS1_Windows_Servers.txt)  -FilterHashTable @{
    + CategoryInfo          : InvalidArgument: (:) [Get-WinEvent], ParameterBindingException
    + FullyQualifiedErrorId : CannotConvertArgument,Microsoft.PowerShell.Commands.GetWinEventCommand

Thanks for your help :)
0
 
LVL 71

Expert Comment

by:Qlemo
ID: 39888564
Oh, that's true, Get-WinEvent does not allow for a string array for -ComputerName ...
get-content C:\ADMS1_Servers.txt | % {
  Get-WinEvent -Computer $_  -FilterHashTable @{
    logname = 'system'
    ID = 11
    StartTime = 17/02/2014
}} | ft * -auto

Open in new window

0
 

Author Comment

by:Kay
ID: 39892149
HI Guys,

I tried this code below:

Get-EventLog -Computer (get-content C:\ADMS1_Windows_Servers.txt) -LogName system -After 17/02/2014 | where {$_.eventid -match "7|11|51|52"}   | ft * -auto

Open in new window


However the -match gives me anything with a 7 or 11 e.g  00711 or 1231144? How can I get it to match only the number I've specified?

Also it takes ages, I let it running all night then when I came back tomorrow morning and it was still running, then I pressed cntrl + c , then it gave me some results.
0
 
LVL 71

Accepted Solution

by:
Qlemo earned 2000 total points
ID: 39892358
ft -auto requires to get all output collected before pushing to the screen, so that's the reason you see results not before collecting is stopped. You can see the results earlier if you remove the -auto.

I can't answer for the "for ages" part - it shouldn't. Get-EventLog isn't fast, but it should not run for hours ...

Instead of the match you should use -contains:
Get-EventLog -Computer (get-content C:\ADMS1_Windows_Servers.txt) -LogName system -After 17/02/2014 | where {7, 11, 51, 52 -contains $_.eventid}   | ft * -auto

Open in new window

0

Featured Post

The Orion Papers

Are you interested in becoming an AWS Certified Solutions Architect?

Discover a new interactive way of training for the exam.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Background Information Recently I have fixed file server permission issues for one of my client. The client has 1800 users and one Windows Server 2008 R2 domain joined file server with 12 TB of data, 250+ shared folders and the folder structure i…
Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
The viewer will learn how to look for a specific file type in a local or remote server directory using PHP.
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

721 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question