Solved

Powershell get-eventlog very time consuming

Posted on 2014-02-25
9
425 Views
Last Modified: 2014-03-03
HI Guys,

When I try this code it takes ages!!, please help:

get-content C:\ADMS1_Servers.txt | foreach {Get-EventLog -computername $_ -LogName system -After 17/02/2014 | where {$_.eventid -eq "11"} } | select *

It takes so long that I've never seen it complete. PLease help!
0
Comment
Question by:Kay
  • 4
  • 3
  • 2
9 Comments
 
LVL 34

Expert Comment

by:Dan Craciun
Comment Utility
How long does it take for a single server?
I mean if C:\ADMS1_Servers.txt contains a single server.
0
 

Author Comment

by:Kay
Comment Utility
ive tried that, it takes forever, I just gave up in the end.
0
 
LVL 34

Expert Comment

by:Dan Craciun
Comment Utility
OK. This:
Get-EventLog -LogName system -After 2/17/2014 | where {$_.eventid -eq "11"}

Open in new window

returned results after 1 second.

Make sure your locale is correct. On my system 17/02/2014 threw an error

HTH,
Dan
0
 

Author Comment

by:Kay
Comment Utility
that im sure is correct as our systems are on the UK format :)
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 68

Expert Comment

by:Qlemo
Comment Utility
You might see an improvement if you allow Get-EventLog to manage the PCs itself, or use Get-WinEvent -FilterHashTable (which allows for filtering for an event id):
Get-EventLog -Computer (get-content C:\ADMS1_Servers.txt) -LogName system -After 17/02/2014 | where {$_.eventid -eq "11"} }  | ft * -auto
Get-WinEvent -Computer (get-content C:\ADMS1_Servers.txt)  -FilterHashTable @{
  logname = 'system'
  ID = 11
  StartTime = 17/02/2014
} | ft * -auto

Open in new window

(Dates in UK format of dd/mm/yyyy).
0
 

Author Comment

by:Kay
Comment Utility
HI Qlemo,

The get-eventlog still takes very, I can't even cancel out of it by pressing cntrl + c.

The get-winevent doesn't work, its gives me this error message:

Get-WinEvent : Cannot convert 'System.Object[]' to the type 'System.String' required by parameter 'Co
fied method is not supported.
At line:1 char:23
+ Get-WinEvent -Computer <<<<  (get-content C:\ADMS1_Windows_Servers.txt)  -FilterHashTable @{
    + CategoryInfo          : InvalidArgument: (:) [Get-WinEvent], ParameterBindingException
    + FullyQualifiedErrorId : CannotConvertArgument,Microsoft.PowerShell.Commands.GetWinEventCommand

Thanks for your help :)
0
 
LVL 68

Expert Comment

by:Qlemo
Comment Utility
Oh, that's true, Get-WinEvent does not allow for a string array for -ComputerName ...
get-content C:\ADMS1_Servers.txt | % {
  Get-WinEvent -Computer $_  -FilterHashTable @{
    logname = 'system'
    ID = 11
    StartTime = 17/02/2014
}} | ft * -auto

Open in new window

0
 

Author Comment

by:Kay
Comment Utility
HI Guys,

I tried this code below:

Get-EventLog -Computer (get-content C:\ADMS1_Windows_Servers.txt) -LogName system -After 17/02/2014 | where {$_.eventid -match "7|11|51|52"}   | ft * -auto

Open in new window


However the -match gives me anything with a 7 or 11 e.g  00711 or 1231144? How can I get it to match only the number I've specified?

Also it takes ages, I let it running all night then when I came back tomorrow morning and it was still running, then I pressed cntrl + c , then it gave me some results.
0
 
LVL 68

Accepted Solution

by:
Qlemo earned 500 total points
Comment Utility
ft -auto requires to get all output collected before pushing to the screen, so that's the reason you see results not before collecting is stopped. You can see the results earlier if you remove the -auto.

I can't answer for the "for ages" part - it shouldn't. Get-EventLog isn't fast, but it should not run for hours ...

Instead of the match you should use -contains:
Get-EventLog -Computer (get-content C:\ADMS1_Windows_Servers.txt) -LogName system -After 17/02/2014 | where {7, 11, 51, 52 -contains $_.eventid}   | ft * -auto

Open in new window

0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Suggested Solutions

You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
Set OWA language and time zone in Exchange for individuals, all users or per database.
The viewer will learn how to create and use a small PHP class to apply a watermark to an image. This video shows the viewer the setup for the PHP watermark as well as important coding language. Continue to Part 2 to learn the core code used in creat…
In this fourth video of the Xpdf series, we discuss and demonstrate the PDFinfo utility, which retrieves the contents of a PDF's Info Dictionary, as well as some other information, including the page count. We show how to isolate the page count in a…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now