Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

PowerShell Script for alerting on when logs are modified or exceed a certain size

Posted on 2016-08-30
5
Medium Priority
?
48 Views
Last Modified: 2016-09-01
Hi All

I am working on a PowerShell script that will alert on:

1) If a log file has been written to in the last 24 hours
2) If a log file exceeds x MB in size

Currently when I run the script I get 14 emails when running the script instead of the expected 1 as no files have been written to in several days and only 1 file is over 10MB in size.

# Name   :   Log file Alerts (Modified in last 24 hours or exceeded 10MB)
# Date   :   
# Author :   
#
# This script will check the date modified of log files and alert if they have been written to in the last 24 hours
# It will alert to email when the log files exceeds X MB in size

##############  User editable variables ##############
$Server = "8300-15041"
$LogType = "CDs & Notification Server Log File Checks"
$log = 'C:\MATSTEST\'
$LogURL = "\\8300-15041\c$\MATSTEST"
$MaxLogSize = 10MB

##############  Set Email variables ##########
$smtp = "mail.xxxxxxx.xxx" 
#$Recipients = "Application Support <matthew.emery@xxxxxxx.xxx>" 
[String[]]$Recipients = "matthew.emery@xxxxxxx.xxx" #Use for multiple recipients
$from = "noreply@xxxxxxx.xxx"
$subject = "Urgent! $Server $LogType Errors exist within the last 24 hours"
$subject2 = "Urgent! $Server $LogType Log file exceeded 10MB"
$body  = "Please log into <b><font color=red>$Server</font></b> and check $LogURL Log files<br>"
$body += "Click Here"

############## Search log directory for .log files written to within the last 24 hours ############## 

get-item $Log\*.log -Exclude "Notification Server (NOTIFICATION)_pager*" | ForEach-Object {


    ############## Send email alert if log file has been written to within the last 24 hours ##############
    IF ($_.LastWriteTime -gt (get-date).AddDays(-1)) {
        Send-MailMessage    -From $from -To $Recipients -Subject "$subject" -Body "$body" -BodyAsHtml -Priority high -Smtpserver $SMTP;       
    }

    ############## Email alert if log file has grown to over 10MB ##############
    $LogSize = Get-ChildItem $log | select length -ExpandProperty Length
    IF ($LogSize -gt $MaxLogSize) {
    Send-MailMessage    -From $from -To $Recipients -Subject "$subject2" -Body "$body" -BodyAsHtml -Priority high -Smtpserver $SMTP;
    }
}

else {exit}

Open in new window


I nearly forgot ...... As per line 27 I want to add further exceptions such as 'Notification Server (NOTIFICATION)_email' but I am not sure what formatting to use when using multiple exceptions

Mail Server and email addresses have been removed prior to posting the code

Any help on this issue would be really appreciated.
0
Comment
Question by:IM&T SRFT
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 41

Accepted Solution

by:
footech earned 2000 total points
ID: 41776671
The problem is with line 36.  Every time through the loop started on line 27, you were doing another loop searching for the same files.  If you just change line 36 to the following I think you're good.
    $LogSize = $_.Length

Open in new window

0
 

Author Comment

by:IM&T SRFT
ID: 41779329
Hi Footech,

Thank you so much that worked a treat!

I don't suppose you could advise about the other part where I wanted to add further exceptions to line 27.  I want to add 'Notification Server (NOTIFICATION)_email' to the exception but not sure what character separators to use for additional exceptions.
0
 
LVL 41

Expert Comment

by:footech
ID: 41779571
Sorry, didn't see that earlier.
The simplest way to find the answer is to read the help for the cmdlet.  If I remember correctly, you can just specify a string array (i.e. multiple items separated by commas).  For example:
-exclude "one*","two*"
0
 

Author Closing Comment

by:IM&T SRFT
ID: 41779803
Thank you for your help it is very much appreciated!

Have not quite nailed the exclusions but nearly there.
0
 
LVL 41

Expert Comment

by:footech
ID: 41780151
Also, more complex filtering could be done by piping to Where-Object and setting conditions there.
0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Windows 10 came with  a lot of built in applications, Some organisations leave them there, some will control them using GPO's. This Article is useful for those who do not want to have any applications in their image (example:me).
In previous parts of this Nano Server deployment series, we learned how to create, deploy and configure Nano Server as a Hyper-V host. In this part, we will look for a clustering option. We will create a Hyper-V cluster of 3 Nano Server host nodes w…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…
In response to a need for security and privacy, and to continue fostering an environment members can turn to for support, solutions, and education, Experts Exchange has created anonymous question capabilities. This new feature is available to our Pr…

662 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question