Powershell Script for Monitoring Live Log files

sransbottom · 2019-02-01T18:54:37.000Z

Looking for anyone that might have or guide me to a PS Script for monitoring a live log, need to alert after ‘X’ Minutes of inactivity… Thanks

Neally · 2019-02-01T19:28:44.000Z

What have you tried? Where are you stuck?

We’re not a script writing service but happy to help

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don’t say “Need help” or “PowerShell Help”, actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy…

Neally · 2019-02-01T19:29:37.000Z

Depending on your needs you can set a scheduled task to kick of every 5 ( or whatever you need) minutes that checks the last write time to the logfile.

If the last write time is less than x minutes, it will send an email or something. totally doable.

tommctomerson · 2019-02-01T21:20:27.000Z

$log = "System"
$path = "C:\Monitor.csv"
 $date = Get-Date
 $date = $date.AddMinutes(-10)
  Get-WinEvent -MaxEvents 100 -FilterHashtable @{Logname=$log;StartTime=$date }|format-Table -auto -wrap | out-file $path
 $monitor = start-job -name 'LiveM0nitor' -ScriptBlock{
 While(1 -eq 1){
 $date = Get-Date
 $date = $date.AddSeconds(-$timer.seconds)
 $timer = Measure-Command{
Get-WinEvent -MaxEvents 100 -FilterHashtable @{Logname=$log; StartTime=$date} |format-Table -auto -wrap | Out-File "D:\Monitor.csv"  -Append -Force
 Start-Sleep -Seconds 1 }}}
 Write-host $date
 Start-sleep -Seconds 1
 Get-Content $path -Wait | Out-GridView

This will tail a log file, just change $log to what ever log you want. hope it helps.

hedexitor · 2019-02-01T22:58:18.000Z

Neally has the right of this one. You certainly can use a script that sits in memory and checks up on the log periodically, but leaving that running constantly while it isn’t doing anything except passing the time isn’t really best practice. A better option would be to write a script that does a quick check on the log file, and call it every so often from Task Scheduler. Assuming the last write time of the log file is a good indicator of activity, you can use something like this:

if((Get-ChildItem c:\path\to\your.log).LastWriteTime -lt (Get-Date).AddMinutes(-10))
{
(log has been inactive for 10 minutes, take alert action)
}

@alexw

rockn · 2019-02-02T14:39:04.000Z

Use a real log analyzer/parser that is its primary function.

jeffreycummings · 2019-02-04T02:37:36.000Z

Write one in C or C++… or heck C# even.

Jeff

sransbottom · 2019-02-04T12:49:06.000Z

Neally:

What have you tried? Where are you stuck?

We’re not a script writing service but happy to help

If you post code, please use the ‘Insert Code’ button. Please and thank you!
PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum!

Quite frankly, I am not a programmer, this is why I ask for assistance and REALLY appreciate the assistance - I try to take whats out there and tweak it for my use, sometimes it works, sometimes, well major failure…

That said… reviewing the other posts to see if I can figure this out… Thanks!

sransbottom · 2019-02-04T12:50:06.000Z

Rockn:

Use a real log analyzer/parser that is its primary function.

Is there one you would recommend?

Neally · 2019-02-04T15:41:55.000Z

sransbottom:

Neally:

What have you tried? Where are you stuck?

We’re not a script writing service but happy to help

If you post code, please use the ‘Insert Code’ button. Please and thank you!
PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum!

Quite frankly, I am not a programmer, this is why I ask for assistance and REALLY appreciate the assistance - I try to take whats out there and tweak it for my use, sometimes it works, sometimes, well major failure…

That said… reviewing the other posts to see if I can figure this out… Thanks!

Scripting and programming are 2 different worlds. For what you need it does not sound like you need elaborate programming skills.
Every SysAdmin should have some scripting skills, especially if you work with Windows, you want to add PowerShell to your repertoire.

See the getting started guide we have pinned here.
https://community.spiceworks.com/windows/articles/3088-how-do-i-learn-powershell