How to truncate a .log file but retain present day logs

PowerShell Help
1

I’m a newbie in terms of PowerShell. My problem is how I can truncate or remove -1 day logs and pass it to a new backup text file.

First Attempt (fail) - because I can’t retain the source log with present-day logs in it or clear it.

Get-Content -Path D:\TempOrder\Olddata.log | where {$PSItem.LastWriteTime -lt (Get-Date).AddDays(-4)} | Set-Content "D:\TempOrder\ServerLog_$(get-date -f yyyy-MM-dd).txt"  | Clear-Content

Second Attempt - I’m still learning how trim works but it failed too, I’m trying to look for ways to put it to a file.

Get-Content D:\TempOrder\Olddata.log | foreach{
if($PSItem.LastWriteTime -lt (Get-Date).AddDays(-2)){
$result = $_.split(':')[1].trim()
$result
}
}

Sample data in the log, first characters are number line space with date and time stamp. Example:

1: 14-May-2020 18:00:00.445: SYSTEM:[main] Logging started

2: 14-May-2020 18:04:00.445: DEBUG [main]…

 

 

Hope someone can enlighten me, thank you in advance. Appreciate your help for a noob like me :slight_smile:

 

 

2

Kernel, welcome to Powershell.org. Please take a moment and read the very first post on top of the list of this forum: Read Me Before Posting! You’ll be Glad You Did!.

When you post code, error messages, sample data or console output format it as code, please.
In the “Text” view you can use the code tags “PRE”, in the “Visual” view you can use the format template “Preformatted”. You can go back edit your post and fix the formatting - you don’t have to create a new one.
Thanks in advance.

When you read a log file with Get-Content you get strings. They don’t have a property LastWriteTime you could check. So you have to parse the strings and extract the string representation of the timestamps. Then you can convert this to type [DateTime] to be able to check if it meets the conditions you want.

Here is an example of how you could start:

$SourceData = @(
'1: 14-May-2020 18:00:00.445: SYSTEM:[main] Logging started',
'2: 14-May-2020 18:04:00.445: DEBUG [main] Logging comntinued'
)
$SourceData | 
    ForEach-Object {
        [PSCustomObject]@{
            Source = $_
            DateTime = Get-Date $_.Substring(4,23)
        }
    }
3

Kernel, welcome to Powershell.org. Please take a moment and read the very first post on top of the list of this forum: Read Me Before Posting! You’ll be Glad You Did!.

First, you are trying to access a property that doesn’t exist. There is no attribute for those lines to say when they were written. You can check for certain properties or all properties.

Get-Content C:\Temp\Olddata.log | foreach{
    $psitem | Get-Member -Name 'lastwritetime'
}

Get-Content C:\Temp\Olddata.log | foreach{
    $psitem | Get-Member -MemberType Properties
}

Luckily you have a date/time stamp, so you could check that after you extract it. Unfortunately, you are breaking sections up with : so not the best choice to split with. You should be able to reconstruct your datetime object like this

Get-Content C:\Temp\Olddata.log | foreach{
   $datetime = (($_.split() | Select-Object -Skip 1 -First 2) -join ' ').trim(':')
   [datetime]$datetime
}

Now you can compare and output the appropriate lines. Note, you want to use -gt to get the entries that are within the last day, -lt shows you the older entries. You could achieve both goals like this.

$oldlog = "D:\TempOrder\Olddata.log"
$content = Get-Content $oldlog
Clear-Content $oldlog
$content | foreach{
    [datetime]$linedatetime = (($_.split() | Select-Object -Skip 1 -First 2) -join ' ').trim(':')
    if($linedatetime -gt (Get-Date).AddDays(-1)){
        $_
    } else {
        $_ | Add-Content $oldlog
    }
} | Set-Content "D:\TempOrder\ServerLog_$(get-date -f yyyy-MM-dd).txt"

This will take the lines for the last 24 hours, stick them in “D:\TempOrder\ServerLog_$(get-date -f yyyy-MM-dd).txt”, and remove them from $oldlog. You may need to reverse the order of output if it adds the content back in the wrong order. Hope this helps.

Edit: Based on your title, I think I got it backwards. If so, just switch -gt to -lt and the reverse will happen. Any logs older than the time specified will go to $oldlog and the rest will go to serverlog.