CODEWITHSUNDEEP
windowspowershell
Roland77
Roland77

Reputation: 15

Powershell Script Not Pulling Event from Event Log

Breaking my brian here trying to figure out why this won't pull events from the event log?

I am seeing the event in the event log with the message "The backup operation has completed."

The Event ID is: 14 located under Log Name: Microsoft-Windows-Backup/Operational

$PastHours = 24

$StartAt = (Get-Date).AddHours(-$PastHours)
$ErrorActionPreference = "SilentlyContinue"

$FilterHashTable = @{
    logname   = "Microsoft-Windows-Backup/Operational"
    id        = 14
    StartTime = $StartAt
}

$actions = (Get-WinEvent -FilterHashtable $FilterHashTable | 
    Where-Object {($_.Message -like "*operation*")})

if ($actions){
    ForEach($action in $actions){
        $Result = "OK: Windows Backup Completed Successfully"
        Write-Host $Result
        Exit 0
    }
}
elseif ($action.count -eq "0") {
    $Result = "CRITICAL: Windows Backup has not run in past $PastHours hours "
    Write-Host $Result
    Exit 2
}
else {
    $Result = "CRITICAL: Windows Backup has not run in past $PastHours hours "
    Write-Host $Result
    Exit 2
}

I run the script and confirm that every time that $action.count is 0.. The event is present and was run last at 8/8/2018 2:12 PM

Any suggestions?

Upvotes: 0

Views: 462

Answers (1)

Roland77
Roland77

Reputation: 15

Thanks Jacob, you're right.

It's working now using:

Param(
    [string]$PastHours
)

$StartAt = (Get-Date).AddHours(-$PastHours)
$ErrorActionPreference = "SilentlyContinue"

$FilterHashTable = @{
    logname   = "Microsoft-Windows-Backup"
    id        = 4
    StartTime = $StartAt
}

$actions = (Get-WinEvent -FilterHashtable $FilterHashTable | 
    Where-Object {($_.Message -like "*successfully*")})

if ($actions){
    ForEach($action in $actions){
        $Result = "OK: Windows Backup Completed Successfully at {1} " -F $Task,$action.TimeCreated
        Write-Host $Result
        Exit 0
    }
}
elseif ($action.count -eq "0") {
    $Result = "CRITICAL: Windows Backup has not run in past $PastHours hours"
    Write-Host $Result
    Exit 2
}
else {
    $Result = "CRITICAL: Windows Backup has not run in past $PastHours hours"
    Write-Host $Result
    Exit 2
}

Upvotes: 1

Related Questions