Solved

PowerShell Script for alerting on when logs are modified or exceed a certain size

Posted on 2016-08-30
5
44 Views
Last Modified: 2016-09-01
Hi All

I am working on a PowerShell script that will alert on:

1) If a log file has been written to in the last 24 hours
2) If a log file exceeds x MB in size

Currently when I run the script I get 14 emails when running the script instead of the expected 1 as no files have been written to in several days and only 1 file is over 10MB in size.

# Name   :   Log file Alerts (Modified in last 24 hours or exceeded 10MB)
# Date   :   
# Author :   
#
# This script will check the date modified of log files and alert if they have been written to in the last 24 hours
# It will alert to email when the log files exceeds X MB in size

##############  User editable variables ##############
$Server = "8300-15041"
$LogType = "CDs & Notification Server Log File Checks"
$log = 'C:\MATSTEST\'
$LogURL = "\\8300-15041\c$\MATSTEST"
$MaxLogSize = 10MB

##############  Set Email variables ##########
$smtp = "mail.xxxxxxx.xxx" 
#$Recipients = "Application Support <matthew.emery@xxxxxxx.xxx>" 
[String[]]$Recipients = "matthew.emery@xxxxxxx.xxx" #Use for multiple recipients
$from = "noreply@xxxxxxx.xxx"
$subject = "Urgent! $Server $LogType Errors exist within the last 24 hours"
$subject2 = "Urgent! $Server $LogType Log file exceeded 10MB"
$body  = "Please log into <b><font color=red>$Server</font></b> and check $LogURL Log files<br>"
$body += "Click Here"

############## Search log directory for .log files written to within the last 24 hours ############## 

get-item $Log\*.log -Exclude "Notification Server (NOTIFICATION)_pager*" | ForEach-Object {


    ############## Send email alert if log file has been written to within the last 24 hours ##############
    IF ($_.LastWriteTime -gt (get-date).AddDays(-1)) {
        Send-MailMessage    -From $from -To $Recipients -Subject "$subject" -Body "$body" -BodyAsHtml -Priority high -Smtpserver $SMTP;       
    }

    ############## Email alert if log file has grown to over 10MB ##############
    $LogSize = Get-ChildItem $log | select length -ExpandProperty Length
    IF ($LogSize -gt $MaxLogSize) {
    Send-MailMessage    -From $from -To $Recipients -Subject "$subject2" -Body "$body" -BodyAsHtml -Priority high -Smtpserver $SMTP;
    }
}

else {exit}

Open in new window


I nearly forgot ...... As per line 27 I want to add further exceptions such as 'Notification Server (NOTIFICATION)_email' but I am not sure what formatting to use when using multiple exceptions

Mail Server and email addresses have been removed prior to posting the code

Any help on this issue would be really appreciated.
0
Comment
Question by:IM&T SRFT
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 40

Accepted Solution

by:
footech earned 500 total points
ID: 41776671
The problem is with line 36.  Every time through the loop started on line 27, you were doing another loop searching for the same files.  If you just change line 36 to the following I think you're good.
    $LogSize = $_.Length

Open in new window

0
 

Author Comment

by:IM&T SRFT
ID: 41779329
Hi Footech,

Thank you so much that worked a treat!

I don't suppose you could advise about the other part where I wanted to add further exceptions to line 27.  I want to add 'Notification Server (NOTIFICATION)_email' to the exception but not sure what character separators to use for additional exceptions.
0
 
LVL 40

Expert Comment

by:footech
ID: 41779571
Sorry, didn't see that earlier.
The simplest way to find the answer is to read the help for the cmdlet.  If I remember correctly, you can just specify a string array (i.e. multiple items separated by commas).  For example:
-exclude "one*","two*"
0
 

Author Closing Comment

by:IM&T SRFT
ID: 41779803
Thank you for your help it is very much appreciated!

Have not quite nailed the exclusions but nearly there.
0
 
LVL 40

Expert Comment

by:footech
ID: 41780151
Also, more complex filtering could be done by piping to Where-Object and setting conditions there.
0

Featured Post

[Live Webinar] The Cloud Skills Gap

As Cloud technologies come of age, business leaders grapple with the impact it has on their team's skills and the gap associated with the use of a cloud platform.

Join experts from 451 Research and Concerto Cloud Services on July 27th where we will examine fact and fiction.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Synchronize a new Active Directory domain with an existing Office 365 tenant
Recently we ran in to an issue while running some SQL jobs where we were trying to process the cubes.  We got an error saying failure stating 'NT SERVICE\SQLSERVERAGENT does not have access to Analysis Services. So this is a way to automate that wit…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…
Monitoring a network: how to monitor network services and why? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the philosophy behind service monitoring and why a handshake validation is critical in network monitoring. Software utilized …

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question