CODEWITHSUNDEEP
powershell
user2817379
user2817379

Reputation: 21

PowerShell: get-eventlog takes too long to complete

I am trying to script the review of the past 30 days of the Application and System Event Logs on remote servers, looking for only Warnings, Errors, or Critical entries.

Borrowing from what I have found here and in other forums, I have come up with:

$Date = Get-Date
$Range = $Date.AddDays(-30)
$Range = $range.ToShortDateString();
$LogName = Read-Host "Which Log? (Application, System)"
$Server = Read-Host "Please Enter Server Name"

get-eventlog $LogName -ComputerName $Server -After $range | where {$_.EntryType -eq "Error" -or $_.EntryType -eq "Warning" -or $_.EntryType -eq  "Critical"}

This seems to run fairly quickly, but then hangs several (5-10+) minutes before returning to a prompt, if it does....

Note: if I remove the code:

-After $range

I can simply break the output with ctrl-c and get on with my day, but I'd rather it run as intended and then stop...

So: Any ideas on how to eliminate this hang?
I am also open to ideas on how to make the code more elegant (and faster)! And I wouldn't mind the script checking both the Application and System logs without having to run twice....

Upvotes: 2

Views: 9817

Answers (2)

Bewc
Bewc

Reputation: 441

I found that for remote systems, I could query several systems at once faster than I could individually, using the same command, if I wrapped it into an Invoke-Command. This is my solution. The more systems, the more time it saved. YMMV

$command = {Get-EventLog -LogName Application -After (Get-Date).AddHours("-24")}
Invoke-Command -ComputerName "foo1","foo2","foo3","foo4" -ScriptBlock $command

Upvotes: 2

dpw
dpw

Reputation: 1586

Using the -EntryType string-array parameter on Get-EventLog is much faster than retrieving the entire event log and then filtering with Where-Object

Try get-eventlog -Logname System -EntryType ("Error", "Warning")

However... if I put "Critical" in the -EntryType array, I get: The argument "Critical" does not belong to the set "Error,Information,FailureAudit,SuccessAudit,Warning" specified by the ValidateSet attribute. which makes me wonder whether you should be heeding the advice as listed in Get-Help Get-EventLog:

The cmdlets that contain the EventLog noun (the EventLog cmdlets) work only on classic event logs. To get events from logs that use the Windows Event Log technology in Windows Vista and later versions of Windows, use Get-WinEvent.

Using Get-WinEvent instead, I think this is what you want: Get-Winevent -FilterHashtable @{LogName="System","Application"; Level=1,2,3; startTime=$range}

That will check for events of level 1, 2, or 3 (Critical, Error, Warning, respectively), and search both the Application and System logs in the same invocation.

Upvotes: 2

Related Questions