Solved

Powershell get-eventlog very time consuming

Posted on 2014-02-25
9
471 Views
Last Modified: 2014-03-03
HI Guys,

When I try this code it takes ages!!, please help:

get-content C:\ADMS1_Servers.txt | foreach {Get-EventLog -computername $_ -LogName system -After 17/02/2014 | where {$_.eventid -eq "11"} } | select *

It takes so long that I've never seen it complete. PLease help!
0
Comment
Question by:Kay
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 2
9 Comments
 
LVL 35

Expert Comment

by:Dan Craciun
ID: 39885632
How long does it take for a single server?
I mean if C:\ADMS1_Servers.txt contains a single server.
0
 

Author Comment

by:Kay
ID: 39885664
ive tried that, it takes forever, I just gave up in the end.
0
 
LVL 35

Expert Comment

by:Dan Craciun
ID: 39885700
OK. This:
Get-EventLog -LogName system -After 2/17/2014 | where {$_.eventid -eq "11"}

Open in new window

returned results after 1 second.

Make sure your locale is correct. On my system 17/02/2014 threw an error

HTH,
Dan
0
Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 

Author Comment

by:Kay
ID: 39885823
that im sure is correct as our systems are on the UK format :)
0
 
LVL 69

Expert Comment

by:Qlemo
ID: 39885914
You might see an improvement if you allow Get-EventLog to manage the PCs itself, or use Get-WinEvent -FilterHashTable (which allows for filtering for an event id):
Get-EventLog -Computer (get-content C:\ADMS1_Servers.txt) -LogName system -After 17/02/2014 | where {$_.eventid -eq "11"} }  | ft * -auto
Get-WinEvent -Computer (get-content C:\ADMS1_Servers.txt)  -FilterHashTable @{
  logname = 'system'
  ID = 11
  StartTime = 17/02/2014
} | ft * -auto

Open in new window

(Dates in UK format of dd/mm/yyyy).
0
 

Author Comment

by:Kay
ID: 39888403
HI Qlemo,

The get-eventlog still takes very, I can't even cancel out of it by pressing cntrl + c.

The get-winevent doesn't work, its gives me this error message:

Get-WinEvent : Cannot convert 'System.Object[]' to the type 'System.String' required by parameter 'Co
fied method is not supported.
At line:1 char:23
+ Get-WinEvent -Computer <<<<  (get-content C:\ADMS1_Windows_Servers.txt)  -FilterHashTable @{
    + CategoryInfo          : InvalidArgument: (:) [Get-WinEvent], ParameterBindingException
    + FullyQualifiedErrorId : CannotConvertArgument,Microsoft.PowerShell.Commands.GetWinEventCommand

Thanks for your help :)
0
 
LVL 69

Expert Comment

by:Qlemo
ID: 39888564
Oh, that's true, Get-WinEvent does not allow for a string array for -ComputerName ...
get-content C:\ADMS1_Servers.txt | % {
  Get-WinEvent -Computer $_  -FilterHashTable @{
    logname = 'system'
    ID = 11
    StartTime = 17/02/2014
}} | ft * -auto

Open in new window

0
 

Author Comment

by:Kay
ID: 39892149
HI Guys,

I tried this code below:

Get-EventLog -Computer (get-content C:\ADMS1_Windows_Servers.txt) -LogName system -After 17/02/2014 | where {$_.eventid -match "7|11|51|52"}   | ft * -auto

Open in new window


However the -match gives me anything with a 7 or 11 e.g  00711 or 1231144? How can I get it to match only the number I've specified?

Also it takes ages, I let it running all night then when I came back tomorrow morning and it was still running, then I pressed cntrl + c , then it gave me some results.
0
 
LVL 69

Accepted Solution

by:
Qlemo earned 500 total points
ID: 39892358
ft -auto requires to get all output collected before pushing to the screen, so that's the reason you see results not before collecting is stopped. You can see the results earlier if you remove the -auto.

I can't answer for the "for ages" part - it shouldn't. Get-EventLog isn't fast, but it should not run for hours ...

Instead of the match you should use -contains:
Get-EventLog -Computer (get-content C:\ADMS1_Windows_Servers.txt) -LogName system -After 17/02/2014 | where {7, 11, 51, 52 -contains $_.eventid}   | ft * -auto

Open in new window

0

Featured Post

NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This article explains how to prepare an HTML email signature template file containing dynamic placeholders for users' Azure AD data. Furthermore, it explains how to use this file to remotely set up a department-wide email signature policy in Office …
A quick Powershell script I wrote to find old program installations and check versions of a specific file across the network.
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
The viewer will learn how to look for a specific file type in a local or remote server directory using PHP.

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question