send only last errors on log files

bibi92
bibi92 used Ask the Experts™
on
Hello,

How can I modify this script for send only the last errors from a logfile :
# ChkFast Check - Version 2.0
# The script check if an error occur in the Chkfast Logs and send
# an email with the error code and the Log file in attachment.

# Chkfast variables
$LogWatchQLog = $Env:LOGschWATCHQ
$ChkFastScanLog = $Env:LOGschSCANDIR
$ChkFastServerLog = $Env:LOGschSERV
$ChkFastScriptFolder = "E:\Script\ChkFastCheck"

# Send Mail variables
$Sender = "<admin.intra>"
$Reciever1 = "<adminsupport.intra>"
$Reciever2 = "<managersupport.dba.com>"

$Subject = "Errors sending files"
$Body = get-content $ChkFastScriptFolder\Body.txt | out-string
$BodyEnd = get-content $ChkFastScriptFolder\BodyEnd.txt | out-string
$smtpServer = “smtprelay1-emea.dba.wans” 
$Encode = New-Object System.text.utf8encoding

# Check ChkFast Service
$ErrorService = ""
$ServiceList = @("schAlert", "schScandir", "schServer", "schWatchq")
$file = New-Item -type File $ChkFastScriptFolder\services.txt -force
$ServiceRapport = Get-Service -Name $ServiceList | out-file $ChkFastScriptFolder\Services.txt
Foreach ($Name in $ServiceList) {
$Service = Get-Service $Name
if ($Service.Status -eq "Stopped"){
	$ErrorService = "True"
	Start-Service $Service.Name
	}
}

# Check Log Errors and Send Mail
$BodyServices = get-content $ChkFastScriptFolder\Services.txt | out-string
$LogErrorFailed = Get-Content $LogWatchQLog | Select-String "failed" -quiet
$LogErrorBlocked = Get-Content $LogWatchQLog | Select-String "blocked" -quiet
$LogErrorEchec = Get-Content $LogWatchQLog | Select-String "Echec" -quiet
$LogErrorErreur5 = Get-Content $LogWatchQLog | Select-String "(Erreur 5)" -quiet
$LogErrorErreur6 = Get-Content $LogWatchQLog | Select-String "(Erreur 6)" -quiet
$LogErrorError = Get-Content $LogWatchQLog | Select-String "error=" -quiet
$LogErrorServerError = Get-Content $ChkFastServerLog | Select-String "error=-9002" -quiet
$LogErrorScanCant = Get-Content $ChkFastScanLog | Select-String "Can't" -quiet

if ($LogErrorFailed -eq $True -or $LogErrorBlocked -eq $True -or $LogErrorEchec -eq $True -or $LogErrorErreur5 -eq $True -or $LogErrorErreur6 -eq $True -or $LogErrorServerError -eq $True -or $LogErrorScanCant -eq $True -or $ErrorService -eq $True){ 
	$LogErrorFailed = Get-Content $LogWatchQLog | Select-String "failed" | out-string
	$LogErrorBlocked = Get-Content $LogWatchQLog | Select-String "blocked" | out-string
	$LogErrorEchec = Get-Content $LogWatchQLog | Select-String "Echec" | out-string
	$LogErrorErreur5 = Get-Content $LogWatchQLog | Select-String "(Erreur 5)" | out-string
	$LogErrorErreur6 = Get-Content $LogWatchQLog | Select-String "(Erreur 6)" | out-string
	$LogErrorError = Get-Content $LogWatchQLog | Select-String "error=" | out-string
	$LogErrorServerError = Get-Content $ChkFastServerLog | Select-String "error=-9002" | out-string
	$LogErrorScanCant = Get-Content $ChkFastScanLog | Select-String "Can't" | out-string
	
	$Body = $Body + "schwatchq.log" + $LogErrorFailed + $LogErrorBlocked + $LogErrorEchec + $LogErrorErreur5 + $LogErrorErreur6 + $LogErrorError + "schserv.log" + $LogErrorServerError + "schscandir.log" + $LogErrorScanCant + $BodyServices + $BodyEnd

	send-mailmessage -from $Sender -to $Reciever1,$Reciever2 -subject $Subject -Body $Body -smtpServer $smtpServer -Encoding $Encode
	}

Open in new window

Thanks

Best regards
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
CoralonSenior Citrix Engineer

Commented:
what are you defining as "last errors?  are you looking at particular categories, etc.?

One of the things you can do is take your variables where you did a get-content, you can do an [array]::reverse($arrayvariable) and reverse the order of the lines in the file and then read them forward, and you'll get your errors in reverse order (newest first)..

Coralon

Author

Commented:
Hello,

I try to send an email if error occured during last hour.
Thanks
Best regards
Senior Citrix Engineer
Commented:
Ok.. then that's easy enough to do, based on what I'm seeing here..

Change this line:
$ServiceRapport = Get-Service -Name $ServiceList | out-file $ChkFastScriptFolder\Services.txt

Open in new window


Replace it with this:
$ServiceRapport = "[$([datetime]::Now)]  $( (Get-Service -Name $ServiceList).ToString() )" | out-file $ChkFastScriptFolder\Services.txt

Then, as you read through the file, you can add a small segment
$Now = [datetime]::Now

foreach ($Line in $LogFile)
{
     $TimeString = (select-string -pattern '\[(.*)\]' -AllMatches | foreach-object { $_.Matches }).Groups[1].value
     $Time = Get-Date $TimeString.
     $TimeSpan = new-timespan -start $now -end $time
     if ($TimeSpan.TotalMinutes -le 60) {  Send-MailMessage ... #(I'm too lazy to type this part out.. but you get it.. ) }
}

Open in new window


But, to be honest I'm not 100% sure exactly how this script is supposed to be working, but I'd think you'd want to just get the status?
(Get-Service -Name $name).Status

Coralon

Author

Commented:
thanks regards

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial