I like that. I will have to keep that concept for future use, in the mean time, I have to tweek what I have for “politcal” reasons.
I got this working except 2 items.
- Export-csv when $events = no Records. When I do this, it exports to the csv file “Length” on 1st line and “16” on 2nd line which is the property of the contents “No Error Records” but when i have actaul log records it exports them correctly.
[Pre]
#Start Get Events Process
#______________________________________________________________________________
$Servers = get-content ‘D:\TEMP\ServerNamesFile.txt’
$ExportPath = “D:\TEMP\ErrorLogFile.csv”
$EmailPath = “D:\TEMP\EmailRecipients.csv”
#Find the DateTimeStamp of when the Exported LogReport was last written
#This will then look for all of the Events that took place prior to that datetimestamp
#__________________________________________________________
$LastWriteTime = [datetime] (Get-ItemProperty -Path $ExportPath).LastWriteTime
#Make sure csv is not read only
sp $ExportPath IsReadOnly $false
If(Test-Path $ExportPath )
{
Remove-Item $ExportPath
}
#Gather the events from all of the servers
#__________________________________________________________
$Events = foreach($Server in $Servers)
{
try
{
Get-Winevent -computername $Server -FilterHashtable @{LogName=“System”, “Application”, “Security”; Level=5,6; startTime=$LastWriteTime} -ErrorAction Stop | #Gathering Events
where-object {$.ID -ne “1111” -or $.ID -ne “1067” -or $.Id -ne “5051”}|
Select-Object @{ e={$.MachineName};l=‘Server’ },@{ e={$.LogName}; l=‘LogName’ },@{ e={$.ID}; l=‘EventID’ },@{ e={$.LevelDisplayName}; l=‘Level’ },@{ e={$.ProviderName}; l=‘Source’ }, @{ e={$.message}; l=‘Message’ },@{ e={$.TimeCreated}; l=‘Created’ }
} #End Try CSV
catch #Start WinEvent Catch
{
If ($.Exception -match “No events were found that match the specified selection criteria”)
{
Continue
}
else
{
“Error occured gathering WinEvents. {0}” -f $.Exception.Message
Continue
}
} #End WinEvent Catch
} #End ForEach Loop
#Start Export CSV, This takes the contents of the $Events and
#Converts them to a csv file (The file is overwritten every time
#__________________________________________________________
write-host "Before Export: " $Events
try #Try Export CSV
{
$RecordCount = ($Events | Measure-Object).Count
if($RecordCount -gt 1)
{
$Events | export-csv -Path $ExportPath -NoTypeInformation -ErrorAction Stop #Exporting csv
}
else
{
$Events = “No Error Records”
$Events | export-csv -Path $ExportPath -NoTypeInformation -ErrorAction Stop #Exporting csv
}
write-host "After Export: " $Events
}#End Export CSV
catch
{
“Error occured exporting csv. {0}” -f $_.Exception.Message
Continue
}
##Send the Email out
#__________________________________________________________
$RecordCount = (Import-csv $ExportPath).count
Write-Host $RecordCount
if ($RecordCount -gt 0)
{
Populate Variables
#concatenate all of the Error Log variables (events)together
[String]$Body = “The Error Files are Located in the Attachements.”
[string]$Subject = "Event Log Results for " + (Get-Date).Adddays(-1)
[string]$Path = “D:\TEMP\ErrorLogFile.csv”
}
Else
{
[string]$Body = “No Errors to Report”
[string]$Subject = "Event Log Results for " + (Get-Date).Adddays(-1) + “: No Errors”
[string]$Path = “None”
}
#update Email information as required
Send the email with All Attachments in Folder
Try #Send Email
{
#call the function to send the email, passing in the subject and body text…(more params can be added, if you want)
$RES = SendEmail $Subject $Body $Path $EmailPath
}
Catch #Start Send Email Catch
{
“Error occured Send-EmailMessage. {0}” -f $_.Exception.Message
Continue
}
Exit
[/Pre]