CODEWITHSUNDEEP
windowspowershell-2.0
razzle_dazzle_84
razzle_dazzle_84

Reputation: 55

Get unique events from Event Log and their count

I have a working script that is able to pull a report of Windows Application, Security, Setup and System logs that displays only the critical and error events in the past 30 days. However, I would also really like the script to count the number of times each reported critical or error event occurred in the past 30 days. Here's the working command:

Get-EventLog Application -ComputerName $server -After $starttime |
    ? { $_.entryType -Match "Error" -and "Critical" } | 
    Sort-Object EventID -Unique |
    Select-Object TimeGenerated,EventID,Source,Message | 
    ft -AutoSize -Wrap | 
    Out-File $file -Append

And here is an example of the output in the text file:

TimeGenerated       EventID Source                                      Message                                        
-------------       ------- ------                                      -------                                        
7/8/2016 1:23:20 PM       0 SQL Server Report Service                   Service cannot be started. Microsoft.ReportingS
                                                                    ervices.Diagnostics.Utilities.InternalCatalogEx
                                                                    ception: An internal error occurred on the repo
                                                                    rt server. See the error log for more details. 
                                                                       at Microsoft.ReportingServices.Library.Nativ
                                                                    e.GetSid(String name, Int32& length)           
                                                                       at Microsoft.ReportingServices.Library.Nativ
                                                                    e.NameToSid(String name)                       
                                                                       at Microsoft.ReportingServices.Library.Servi
                                                                    ceAppDomainController.StartRPCServer(Boolean fi
                                                                    rstTime)                                       
                                                                       at Microsoft.ReportingServices.Library.Servi
                                                                    ceAppDomainController.Start(Boolean firstTime) 
                                                                       at Microsoft.ReportingServices.NTService.Rep
                                                                    ortService.OnStart(String[] args)              
                                                                       at System.ServiceProcess.ServiceBase.Service
                                                                    QueuedMainCallback(Object state)               
7/8/2016 1:23:20 PM     121 Report Server Windows Service (MSSQLSERVER) The Remote Procedure Call (RPC) service failed 
                                                                    to start.

It would be great to have another column in the results that displays the occurrences of each EventID in the specified time period.

Upvotes: 2

Views: 3575

Answers (1)

DAXaholic
DAXaholic

Reputation: 35358

You could do it like so (line 3 & 4 are new and Count in Select-Object)
Technically you could also remove the -Unique from Sort-Object as after grouping them and passing through only the first item of the group is more or less the same.

Get-EventLog Application -ComputerName $server -After $starttime | 
    ? { $_.entryType -Match "Error" -and "Critical" } |
    Group-Object -Property EventID |
    % { $_.Group[0] | Add-Member -PassThru -NotePropertyName Count -NotePropertyValue $_.Count } |
    Sort-Object EventID -Unique | 
    Select-Object Count, TimeGenerated, EventID, Source, Message | 
    ft -AutoSize -Wrap | 
    Out-File $file -Append

Upvotes: 2

Related Questions