PowerShell腳本每10分鐘監視IIS日誌500錯誤

Question

我試圖設置一個腳本來監視IIS 7.5日誌返回500錯誤。現在我可以做到這一點，但我希望每30分鐘檢查一次。很自然地，我不希望它警告我已經報道過的前500次錯誤。

正如您從下面的腳本中看到的，我已經添加了一個$ time變量來考慮這一點，但是我似乎無法找到使用此變量的方法。任何幫助，將不勝感激。

#Set Time Variable -30 
$time = (Get-Date -Format hh:mm:ss (Get-Date).addminutes(-30)) 
# Location of IIS LogFile 
$File = "C:\Users\here\Documents\IIS-log\"+"u_ex"+(get-date).ToString("yyMMdd")+".log" 
# Get-Content gets the file, pipe to Where-Object and skip the first 3 lines. 
$Log = Get-Content $File | where {$_ -notLike "#[D,S-V]*" } 
# Replace unwanted text in the line containing the columns. 
$Columns = (($Log[0].TrimEnd()) -replace "#Fields: ", "" -replace "-","" -replace "\(","" -replace "\)","").Split(" ") 
# Count available Columns, used later 
$Count = $Columns.Length 
# Strip out the other rows that contain the header (happens on iisreset) 
$Rows = $Log | where {$_ -like "*500 0 0*"} 
# Create an instance of a System.Data.DataTable 
#Set-Variable -Name IISLog -Scope Global 
$IISLog = New-Object System.Data.DataTable "IISLog" 
# Loop through each Column, create a new column through Data.DataColumn and add it to the DataTable 
foreach ($Column in $Columns) { 
    $NewColumn = New-Object System.Data.DataColumn $Column, ([string]) 
    $IISLog.Columns.Add($NewColumn) 
} 
# Loop Through each Row and add the Rows. 
foreach ($Row in $Rows) { 
$Row = $Row.Split(" ") 
$AddRow = $IISLog.newrow() 
for($i=0;$i -lt $Count; $i++) { 
$ColumnName = $Columns[$i] 
$AddRow.$ColumnName = $Row[$i] 
} 
$IISLog.Rows.Add($AddRow) 
} 
$IISLog | select time,csuristem,scstatus 

確定KevinD的幫助和PowerGUI有一定的試驗和錯誤，我按照我的預期工作。這是完成的產品。

#Set Time Variable -30 
$time = (Get-Date -Format "HH:mm:ss"(Get-Date).addminutes(-30)) 
# Location of IIS LogFile 
$File = "C:\Users\here\Documents\IIS-log\"+"u_ex"+(get-date).ToString("yyMMdd")+".log" 
# Get-Content gets the file, pipe to Where-Object and skip the first 3 lines. 
$Log = Get-Content $File | where {$_ -notLike "#[D,S-V]*" } 
# Replace unwanted text in the line containing the columns. 
$Columns = (($Log[0].TrimEnd()) -replace "#Fields: ", "" -replace "-","" -replace "\(","" -replace "\)","").Split(" ") 
# Count available Columns, used later 
$Count = $Columns.Length 
# Strip out the other rows that contain the header (happens on iisreset) 
$Rows = $Log | where {$_ -like "*500 0 0*"} 
# Create an instance of a System.Data.DataTable 
#Set-Variable -Name IISLog -Scope Global 
$IISLog = New-Object System.Data.DataTable "IISLog" 
# Loop through each Column, create a new column through Data.DataColumn and add it to the DataTable 
foreach ($Column in $Columns) { 
    $NewColumn = New-Object System.Data.DataColumn $Column, ([string]) 
    $IISLog.Columns.Add($NewColumn) 
} 
# Loop Through each Row and add the Rows. 
foreach ($Row in $Rows) { 
    $Row = $Row.Split(" ") 
    $AddRow = $IISLog.newrow() 
    for($i=0;$i -lt $Count; $i++) { 
    $ColumnName = $Columns[$i] 
    $AddRow.$ColumnName = $Row[$i] 
    } 
    $IISLog.Rows.Add($AddRow) 
    } 
    $IISLog | select @{n="Time"; e={Get-Date -Format "HH:mm:ss"("$($_.time)")}},csuristem,scstatus | ? { $_.time -ge $time } 

再次感謝Kev你是個好人。希望這段代碼能夠幫助別人。

這裏的

Answer 1

試着改變你的最後一行：

$IISLog | select @{n="DateTime"; e={Get-Date ("$($_.date) $($_.time)")}},csuristem,scstatus | ? { $_.DateTime -ge $time } 

在選擇，我們串接日期和時間字段，並將其轉換爲一個日期對象，然後選擇行，其中本字段大於您的$ time變量。

你還需要改變你的$時間變量：

$time = (Get-Date).AddMinutes(-30) 

你想在這裏DateTime對象，而不是字符串。