Checking The Event Log With PowerShell

Good administrators work really hard so that they don’t have to work really hard. Well, that’s an oxymoronic statement if I’ve ever written one. So what do I mean?

Smart administrators are willing to spend time automating as much of their routine work as possible. Why go through the hassle of manually checking a long list of servers on a periodic basis when you can configure a scheduled task to do it for you and report only the exceptions. Smart administrators know that the effort to set up these processes on the front-end will pay dividends on the back-end, freeing them up to handle the exceptions or to play with the latest and greatest technology.

Checking Event Logs With PowerShell

Let’s take a simple example using PowerShell.

It’s a good practice to regularly review the Windows Event Log on the your servers to make sure things are going smoothly. You could make a note to remind you to manually connect to each server and sift through its event log. But that would be cumbersome and time intensive.

That’s where PowerShell can help. The following one-line PowerShell script will check the Event Log on a server, looking for only the Errors that have occurred within the past week. It doesn’t report the informational and warning entries, only the errors.

Get-EventLog Application -EntryType Error -After (Get-Date).AddDays(-7);

You can schedule this to run daily, weekly, or some other interval by changing the -7 parameter on the AddDays method.

Emailing The Results

“That’s great, but it’d be even more convenient to have the result automatically delivered to my inbox.” You can do that.

$smtp_server = “mysmtpserver”;
$to = “joew@myemail.com”;
$from = “administrator@mycompany.com”;
$subject = “Event log from my server”;
$body = Get-EventLog Application -EntryType Error  `
-After (Get-Date).AddDays(-7);

send-mailmessage -to $to -from $from -subject `
$subject -body $body -smtpserver $smtp_server;

And there you have it: the beginning of a PowerShell script to automate a portion of your routine system checks.