Powershell is a well needed addition to Windows. For a longtime there has been Windows admins wanting a powerful and flexible scripting language similar to what Linux / Unix users have had for years, or at least I have.

One of the great command line tools for Linux has been the use of commands like cat, less, more and grep as a few to parse files. Enter in Powershell for Windows. A recent need for parsing the application event log for specific event id 3001 and ASP .NET errors causing an issue with SharePoint servers. With Powershell we can achieve this by using the get-eventlog cmdlet and the where statement to look for the match.

As part of the requirements to the script I wanted to have the ability to put a limit on how far back to look in the application log, write it to a file and if it finds an event that occurred today then send me an email. Here is what came out of it.

# parselogevent.ps1
# Checks for events less than 7 days that occur today and emails.
#

del C:\logs\lastevent.txt

$Now = Get-Date
$SubtractDays= New-Object System.TimeSpan 7,0,0,0,0
$Then = $Now.Subtract($SubtractDays)

$lastevent_log=get-eventlog application -after $Then -before $Now | where {$_.Message -match “3001″ -and $_.Source -match “ASP.NET 2.0.50727.0″} | format-table -wrap -autosize -property TimeWritten, Message > C:\Support\lastevent.txt

$lastevent_file=[io.file]::ReadAllText(‘C:\logs\lastevent.txt’)

$files = “C:\logs\lastevent.txt”

$exist = test-path $files

$today = (get-date).ToShortDateString()

$file = get-childitem $files

if($file.length -gt 0){
$emailFrom = “myemail@myhost.com”
$emailTo = “theman@theman.com”
$subject = “Timeout Error  $env:COMPUTERNAME”
$body = $lastevent_file
$smtpServer = “my.smtp.com”
$smtp = new-object Net.Mail.SmtpClient($smtpServer)
$smtp.Send($emailFrom, $emailTo, $subject, $body)
$lastevent_log.TimeWritten|Set-Content C:\logs\lastevent.txt
}

Now lets explain how it works!!!

First line we want to delete any log exports from before

del C:\logs\lastevent.txt

Now we need to set the variables for date, math to set 7 day and then calculate it all.

$Now = Get-Date
$SubtractDays= New-Object System.TimeSpan 7,0,0,0,0
$Then = $Now.Subtract($SubtractDays)

Now the meat. Lets parse the log an find event id 3001 with message containing ASP.NET 2.0.50727.0 and export to lastevent.txt.

$lastevent_log=get-eventlog application -after $Then -before $Now | where {$_.Message -match “3001″ -and $_.Source -match “ASP.NET 2.0.50727.0″} | format-table -wrap -autosize -property TimeWritten, Message > C:\Support\lastevent.txt

At this point you could look at the exported file and see if you have any events. But we are after automation here, as we are good admins.

Next we need to create some variables to use for formatting and sending the email.

$lastevent_file=[io.file]::ReadAllText(‘C:\logs\lastevent.txt’)

$files = “C:\logs\lastevent.txt”

$exist = test-path $files

$today = (get-date).ToShortDateString()

$file = get-childitem $files

And finally the email piece, this is pretty straight forward and doesn’t need a lot of explaination as the descriptions speak for themselves. You will need to change the values for $emailFrom, $emailTo, $subject & $smtpServer.

if($file.length -gt 0){
$emailFrom = “myemail@myhost.com”
$emailTo = “theman@theman.com”
$subject = “Timeout Error  $env:COMPUTERNAME”
$body = $lastevent_file
$smtpServer = “my.smtp.com”
$smtp = new-object Net.Mail.SmtpClient($smtpServer)
$smtp.Send($emailFrom, $emailTo, $subject, $body)
$lastevent_log.TimeWritten|Set-Content C:\logs\lastevent.txt
}

Save your finished file and give it a run. If it works, then be a good admin and create a scheduled task and move on to the next.

If you want to save a little typing time just download the parselogevent.

Ran into an issue with services stopping for no reason and causing IIS to stop. This was happening in the middle of the night and was sporadic in nature, making it hard to find a root cause. As a band-aid I created a Powershell 2 script to check for the service, restart if not in a running state and send and email.

Here is the script.

# Checks for a service to be running and starts if needed.
# Author: Me
# Date: 01/16/2012
# Name: checksvculti1.ps1
# must use a wrapper script with powershell script due to running at privileged access.

function FuncCheckService{
param($ServiceName)
$arrService = Get-Service -Name $ServiceName
if ($arrService.Status -ne "Running"){
Start-Service $ServiceName
FuncMail -To "myemail@yourhost.com" -From "myserver@yourhost.com"  -Subject "Servername : ($ServiceName) service started." -Body "Service $ServiceName started" -smtpServer "mysmtpserver.com"
}
}

function FuncMail {
param($To, $From, $Subject, $Body, $smtpServer)
$msg = new-object Net.Mail.MailMessage
$smtp = new-object Net.Mail.SmtpClient($smtpServer)
$msg.From = $From
$msg.To.Add($To)
$msg.Subject = $Subject
$msg.IsBodyHtml = 1
$msg.Body = $Body
$smtp.Send($msg)
}

FuncCheckService -ServiceName "IISADMIN"

the script is pretty simple and really has two defined functions FuncCheckService and FuncMail. the last line of the script runs FuncCheckService  and adds the parameter -ServiceName where you define the service you want to check.

Now to modify this script you only have to change a few settings.

The line in FuncCheckService that calls the FuncMail you will need to change

• -To
• -From
• -Body
• -smtpServer

And the last line of the script is where you will define the service to check. Change value after -ServiceName to the service you want to check.

If you notice in the comments for the script I mention that is must be run in a wrapper script. The reason is do to privileges need to be run. I am running this script in Unrestricted mode. The wrapper script looks like this.

powershell.exe -command "Set-ExecutionPolicy Unrestricted -force"
powershell.exe c:\Scripts\checksvculti1.ps1

Save this file and the Powershell script with whatever names you like and in the same directory. You can now schedule this to run as a scheduled task.