Author Posts

February 17, 2016 at 1:40 am

Hi

I am trying to list the number of times servers have been restarted.

I can log inot each server and run the following comand to get the information for each server:

Get-EventLog System | Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} | ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap >c:\scripts\Restart.txt

I am trying to create a script that I can run against a text file, that contains a list of all the servers.

I have tried to create the script but it does not work:

$ServerList = Get-Content "C:\Scripts\ServerList.txt"

foreach ($i in $ServerList)

{$i + "`n" + "=========================="; Get-EventLog System | Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} | ft Machinename, TimeWritten, UserName, EventID -AutoSize | Out-File c:\scripts\ServerRestart.txt $i}

Could you help me will this?

What I would like is for all servers to be added to the same text file.

Many Thanks

Jules

February 17, 2016 at 3:15 am

  • Do your servers have PSRemoting enabled?
  • How many servers are we talking about?
  • Can you access all these servers in the same security context?
  • What version of PowerShell are you running?
  • February 17, 2016 at 4:03 am

    Hi, what Bob said is right, but you were nearly there already, provided your security allows it:

    $ServerList = Get-Content "C:\Scripts\ServerList.txt"
    
    foreach ($i in $ServerList){
        Write-Output $i "`n"+"==========================" | Out-File -FilePath c:\scripts\ServerRestart.txt -Append
        $Output = Get-EventLog System -ComputerName "$i" | Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} | ft Machinename, TimeWritten, UserName, EventID -AutoSize
        $Output | Out-File -FilePath c:\scripts\ServerRestart.txt -Append
     }
    

    February 17, 2016 at 4:46 am

    PSRemoting is not currently enabled – Will emable
    There are 85 Server in two domains
    The script will be run on a DC on each domain so can use two sets of user credentials
    I am currently upgrade all server to v3

    February 18, 2016 at 4:46 am

    Thank you for your help.

    After enabling PSRemoting on the servers the script ran perfectly!!

    Cheers

    Jules

    February 18, 2016 at 6:47 am

    Hi,

    I am trying to add the message to the output file and I get

    Server01.Domain.Local 22/05/2015 17:18:44 Domain\admin 1076 The reason supplied by user Domain\admin for the last unexpected shutdown of this computer is: Other (Unplanned)...

    I have added:

    if( $Host -and $Host.UI -and $Host.UI.RawUI ) {
    $rawUI = $Host.UI.RawUI
    $oldSize = $rawUI.BufferSize
    $typeName = $oldSize.GetType( ).FullName
    $newSize = New-Object $typeName (500, $oldSize.Height)
    $rawUI.BufferSize = $newSize

    to the begining of the script but this does not make any difference.

    Any ideas?

    Thanks

    Jules

    February 18, 2016 at 7:07 am

    Jules, are you wanting it to not concatenate the end of the sentence there? "Other (Unplanned)..."

    If so:

    $ServerList = Get-Content "C:\Scripts\ServerList.txt"
    
    foreach ($i in $ServerList){
        Write-Output $i "`n"+"==========================" | Out-File -FilePath c:\scripts\ServerRestart.txt -Append
        $Output = Get-EventLog System -ComputerName "$i" | Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} | ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap
        $Output | Out-File -FilePath c:\scripts\ServerRestart.txt -Append
     }
    

    I added the -Wrap parameter. That's if you wanted it formatted as a table in-line. Typically I create objects first before formatting them, but this should work for you.

    Edit: Oops, forgot to add the Message object there. Fixed. 🙂

    February 18, 2016 at 8:32 am

    Thanks

    I am looking for it to be a single line. I would like to be about a export the txt to a database or spreadsheet at a late point.

    If it wraps then the file cannot be imported.

    Thanks

    Jules

    February 18, 2016 at 8:46 am

    If you plan to use it in a database or spreadsheet then you should probably have it delimited in some way. Easiest is to export as a csv. See if this will work for you:

    $ServerList = Get-Content "C:\Scripts\ServerList.txt"
    
    foreach ($i in $ServerList){
        Write-Output $i "`n"+"==========================" | Out-File -FilePath c:\scripts\ServerRestart.txt -Append
        $Events = Get-EventLog System -ComputerName "$i" | Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} | Select-Object MachineName, TimeWritten, UserName, EventID, Message
        $Events | Export-Csv -Path c:\scripts\ServerRestart.txt -Append -NoTypeInformation
     }
    

    Note** You will need to delete/rename your current ServerRestart.txt file as it won't have the correct headers.

    February 19, 2016 at 11:14 am

    BTW, I don't get why enabling remoting made your script run perfectly, because there was no remoting used.. If you want to speed things up a little bit, you can actually start using remoting:

    $ServerList = Get-Content "C:\Scripts\ServerList.txt"
    
    $block = {Get-EventLog System | Where-Object {$_.EventID -eq "1074" -or $_.EventID -eq "6008" -or $_.EventID -eq "1076"} | ft Machinename, TimeWritten, UserName, EventID, Message -AutoSize -Wrap }
    
    foreach ($Server in $ServerList){
    Invoke-Command -ComputerName $Server -ScriptBlock $block -AsJob
    }
    
    While (Get-Job -State "Running") {    
        Write-Host -ForegroundColor Yellow "Running..."
        Start-Sleep 1        
    }    
    
    Get-Job| Receive-Job |Out-File C:\scripts\ServerRestart.txt
    Write-Host -ForegroundColor Yellow "Done!"
    

    Obviously you can change the Out-File statement to an Export-Csv statement as Joshua mentions as well 🙂

    PS: I felt the need to put this in a blogpost too 😉