Solved

Powershell get-eventlog very time consuming

Posted on 2014-02-25
9
458 Views
Last Modified: 2014-03-03
HI Guys,

When I try this code it takes ages!!, please help:

get-content C:\ADMS1_Servers.txt | foreach {Get-EventLog -computername $_ -LogName system -After 17/02/2014 | where {$_.eventid -eq "11"} } | select *

It takes so long that I've never seen it complete. PLease help!
0
Comment
Question by:Kay
  • 4
  • 3
  • 2
9 Comments
 
LVL 34

Expert Comment

by:Dan Craciun
ID: 39885632
How long does it take for a single server?
I mean if C:\ADMS1_Servers.txt contains a single server.
0
 

Author Comment

by:Kay
ID: 39885664
ive tried that, it takes forever, I just gave up in the end.
0
 
LVL 34

Expert Comment

by:Dan Craciun
ID: 39885700
OK. This:
Get-EventLog -LogName system -After 2/17/2014 | where {$_.eventid -eq "11"}

Open in new window

returned results after 1 second.

Make sure your locale is correct. On my system 17/02/2014 threw an error

HTH,
Dan
0
Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

 

Author Comment

by:Kay
ID: 39885823
that im sure is correct as our systems are on the UK format :)
0
 
LVL 69

Expert Comment

by:Qlemo
ID: 39885914
You might see an improvement if you allow Get-EventLog to manage the PCs itself, or use Get-WinEvent -FilterHashTable (which allows for filtering for an event id):
Get-EventLog -Computer (get-content C:\ADMS1_Servers.txt) -LogName system -After 17/02/2014 | where {$_.eventid -eq "11"} }  | ft * -auto
Get-WinEvent -Computer (get-content C:\ADMS1_Servers.txt)  -FilterHashTable @{
  logname = 'system'
  ID = 11
  StartTime = 17/02/2014
} | ft * -auto

Open in new window

(Dates in UK format of dd/mm/yyyy).
0
 

Author Comment

by:Kay
ID: 39888403
HI Qlemo,

The get-eventlog still takes very, I can't even cancel out of it by pressing cntrl + c.

The get-winevent doesn't work, its gives me this error message:

Get-WinEvent : Cannot convert 'System.Object[]' to the type 'System.String' required by parameter 'Co
fied method is not supported.
At line:1 char:23
+ Get-WinEvent -Computer <<<<  (get-content C:\ADMS1_Windows_Servers.txt)  -FilterHashTable @{
    + CategoryInfo          : InvalidArgument: (:) [Get-WinEvent], ParameterBindingException
    + FullyQualifiedErrorId : CannotConvertArgument,Microsoft.PowerShell.Commands.GetWinEventCommand

Thanks for your help :)
0
 
LVL 69

Expert Comment

by:Qlemo
ID: 39888564
Oh, that's true, Get-WinEvent does not allow for a string array for -ComputerName ...
get-content C:\ADMS1_Servers.txt | % {
  Get-WinEvent -Computer $_  -FilterHashTable @{
    logname = 'system'
    ID = 11
    StartTime = 17/02/2014
}} | ft * -auto

Open in new window

0
 

Author Comment

by:Kay
ID: 39892149
HI Guys,

I tried this code below:

Get-EventLog -Computer (get-content C:\ADMS1_Windows_Servers.txt) -LogName system -After 17/02/2014 | where {$_.eventid -match "7|11|51|52"}   | ft * -auto

Open in new window


However the -match gives me anything with a 7 or 11 e.g  00711 or 1231144? How can I get it to match only the number I've specified?

Also it takes ages, I let it running all night then when I came back tomorrow morning and it was still running, then I pressed cntrl + c , then it gave me some results.
0
 
LVL 69

Accepted Solution

by:
Qlemo earned 500 total points
ID: 39892358
ft -auto requires to get all output collected before pushing to the screen, so that's the reason you see results not before collecting is stopped. You can see the results earlier if you remove the -auto.

I can't answer for the "for ages" part - it shouldn't. Get-EventLog isn't fast, but it should not run for hours ...

Instead of the match you should use -contains:
Get-EventLog -Computer (get-content C:\ADMS1_Windows_Servers.txt) -LogName system -After 17/02/2014 | where {7, 11, 51, 52 -contains $_.eventid}   | ft * -auto

Open in new window

0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

"Migrate" an SMTP relay receive connector to a new server using info from an old server.
A brief introduction to what I consider to be the best editor for PowerShell.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
In a recent question (https://www.experts-exchange.com/questions/29004105/Run-AutoHotkey-script-directly-from-Notepad.html) here at Experts Exchange, a member asked how to run an AutoHotkey script (.AHK) directly from Notepad++ (aka NPP). This video…

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question