Welcome › Forums › General PowerShell Q&A › Sort Eventlog per machine name
- This topic has 2 replies, 3 voices, and was last updated 5 months ago by
Participant.
-
AuthorPosts
-
-
August 24, 2020 at 3:03 pm #252191
Hello,
I am struggling with a script to show me the number of entry’s for a system log, in a array of servers.
My script shows me the log, that I need, also the number of entry’s only I cannnot get it to work that it shows me a output basedon an per server.Like :
Server 1
Count source eventid message
—– —— ——- ——
—— ——– ——– ——–
Server 2
Count Source eventid Message
—— —– ——- ——
——– ——– ——– ——–
I tried a number of ways, only I miss still some experience in this part it seems..:-)————————–
PowerShell123456$servers = "ggwvappa029","ggwvmapt002","ggwvmfsp001"foreach($server in $servers){invoke-command -computername $server {get-eventlog system -EntryType error -Newest 25}|Select-Object @{name='Servername';expression={$env:Machinename}} ,source, eventid, message |Group-Object servername, count, source -NoElement | sort Servername}-
This topic was modified 5 months ago by
PBA121137. Reason: edited because i did not use the preformatted text for code :)
-
This topic was modified 5 months ago by
-
August 24, 2020 at 5:13 pm #252212
Try something like this which gets all of the results and then groups them:
PowerShell12345678910111213141516171819202122232425262728293031$servers = "ggwvappa029","ggwvmapt002","ggwvmfsp001"$results = foreach($server in $servers){$params = @{LogName = 'system'EntryType = 'error'Newest = 25ComputerName = $serverErrorAction = 'Stop'}try {Get-EventLog @params |Select-Object @{Name='Servername';Expression={$server}},source,eventid,message}Catch {[pscustomobject]@{ServerName = $serverSource = $nullEventId = $nullMessage = 'Failed to connect to server. {0}' -f $_}}}$results |Group-Object servername, count, source -NoElement |Sort Servername -
August 24, 2020 at 7:02 pm #252230
I’m not sure if you’re trying to count each source or just the amount of events in total. Based on the code you have, if you simply change the calculated property as shown here
PowerShell1234$servers = "ggwvappa029","ggwvmapt002","ggwvmfsp001"invoke-command -computername $serverlist {get-eventlog system -EntryType error -Newest 25}|Select-Object @{name='Servername';expression={$_.pscomputername}} ,source, eventid, message |Group-Object servername,source -NoElement | sort ServernameYou end up with output like this
PowerShell1234567Count Name----- ----17 volsnap, server18 stcvsm, server124 NETLOGON, server21 bowser, server225 Schannel, server3I also removed the foreach loop as it’s hurting your execution time. Since you already have the list of servers, if you pass that list directly to Invoke-Command it will run them in parallel. It also returns by default a PSComputerName so we just inserted that to the caclulated servername property. If this is not the output you expected, please try to clarify what you wanted to end up with.
-
-
AuthorPosts
- The topic ‘Sort Eventlog per machine name’ is closed to new replies.