Eventlog script mutiplul servers mutliple logs to htm output

This topic contains 4 replies, has 2 voices, and was last updated by Profile photo of Akos Batorfi Akos Batorfi 9 months ago.

  • Author
    Posts
  • #36396
    Profile photo of Karl Stephens
    Karl Stephens
    Participant

    Hi i am new to powershell but i would like help with a script.I have started i need it to go to X amount of servers and pull the last 7 days of errors and warnings from each server and display in htm. The three logs i need are "directory services, dns server, systems " also needs to filter out everything but errors and warnings. This is what i have so far

    $logPath = "C:\scripts\"
    $log = "system"
    $log1 = "Directory service"
    $computers = "cgasrv01"

    # Start HTML Output file style
    $style = ""
    $style = $style + "Body{background-color:white;font-family:Arial;font-size:10pt;}"
    $style = $style + "Table{border-width: 1px; border-style: solid; border-color: black; border-collapse: collapse;}"
    $style = $style + "TH{border-width: 1px; padding: 2px; border-style: solid; border-color: black; background-color: #cccccc;}"
    $style = $style + "TD{border-width: 1px; padding: 5px; border-style: solid; border-color: black; background-color: white;}"
    $style = $style + ""

    # End HTML Output file style

    $date = get-date -format M.d.yyyy

    $now = get-date
    $subtractDays = New-Object System.TimeSpan 7,0,0,0,0
    $then = $Now.Subtract($subtractDays)

    $systemErrors = Get-EventLog -Computername $computers -LogName $log, $log1 -After $then -Before $now -EntryType Error |
    select EventID,MachineName,Message,Source,TimeGenerated

    $systemErrors | ConvertTo-HTML -head $style | Out-File "$logPath\$computers-$log-$date.htm"

    any help would be appreciated

  • #36397
    Profile photo of Akos Batorfi
    Akos Batorfi
    Participant

    It would help to say what OS you're on, and if you have remoting turned on and if it is in a domain or not.

  • #36398
    Profile photo of Karl Stephens
    Karl Stephens
    Participant

    Apologies i need it to work across both 2008R2 and 2012R2. Remoting is turned on and enabled as i can manually get the eventlog files through powershell and they are all part of a domain

  • #36400
    Profile photo of Akos Batorfi
    Akos Batorfi
    Participant

    I ran your script in my "test lab" (3 vm's):

    The CSS style isn't working the way you're doing it now.

    Doing a quick google for "CSS powershell" gave me this as a nice article http://foxdeploy.com/2014/05/23/using-html-formatting-to-create-useful-webpage-reports-from-powershell/

    I also saw you were trying to get multiple logs with get-eventlog, but you can get only one log at a time.

    So this works a little easier:

    Get-EventLog System -After (Get-Date).AddDays(-7) -EntryType Error | Select-Object EventID,MachineName,Message,Source,TimeGenerated
    

    I'll fudge around some more, to be continued 😉

  • #36401
    Profile photo of Akos Batorfi
    Akos Batorfi
    Participant

    So I made this blogpost recently, so I borrowed some entries from that, so it now gives you a full list of errors and warnings, but it's still a single file. It does work quick though, if you have a large number of machines.

    As you can see you need to make a list of servers that you want to get the logfiles from, then the script reads in those server names, and will get the eventlogs in parallel (therefor faster than one by one)

    $ServerList = Get-Content C:\Scripts\ServerList.txt
    $date = get-date -format M.d.yyyy
    $logPath = "C:\scripts\"
    
    $block = {Get-EventLog -Logname System -After (Get-Date).AddDays(-7) -EntryType Error,Warning | Select-Object EventID,MachineName,Message,Source,TimeGenerated}
    
    $Header = @"
    
    Body{background-color:white;font-family:Arial;font-size:10pt;}
    Table{border-width: 1px; border-style: solid; border-color: black; border-collapse: collapse;}
    TH{border-width: 1px; padding: 2px; border-style: solid; border-color: black; background-color: #cccccc;}
    TD{border-width: 1px; padding: 5px; border-style: solid; border-color: black; background-color: white;}
    
    "@
    
    Invoke-Command -ComputerName $ServerList -ScriptBlock $block | ConvertTo-Html -Head $Header| Out-File "$logPath\Servers-System-$date.htm"
    

    I noticed that the "style" html tags are taken out by the "pre" tags

    Oh yeah, currently only System. Apparently -Logname doesn't like variables. Don't know why..

    So this should be a nice start. You could of course do a second invoke-Command where you run the "Directory Service", but those will need to be run on the DC's only, while the Invoke-Command from above does the non-DC's.

You must be logged in to reply to this topic.