none
Why is my log Truncated for event log export RRS feed

  • Question

  • Hello,

    Not sure if some one has posted something like this, but i just need to see where i can tell why is my list getting truncated once there is too many events. Sometimes i get all of the servers in the list and other just some. Code is listed below. I have omitted 2 lines that show where the file is exported. and import of server list.

    cls
    $ErrorActionPreference = "silentlycontinue"

    $serverlistinput = "\Servers.txt"

    $datetime = Get-Date -Format "yyyyMMdd";
    $today = Get-Date
    $yesterday = $today.AddHours(-24)

    $serverlist = Get-Content $serverlistinput 
    $reportpath = "EventLogs"

    $report = $reportpath + "\Server-Logs-$datetime.htm"
    Clear-Content $report

    [array]$eventlogs = $null
    $eventlogs += "Application"
    $Eventlogs += "System"
    $countarr = $eventlogs.count

    Foreach ($s in $serverlist)
    {
     Add-Content $report "<html>"
     Add-Content $report "<head>"
     Add-Content $report "<meta http-equiv='Content-Type' content='text/html; charset=iso-8859-1'>"
     Add-Content $report '<title>Event Log Report</title>'
     add-content $report '<STYLE TYPE="text/css">'
     add-content $report "<!--"
     add-content $report "td {"
     add-content $report "font-family: Tahoma;"
     add-content $report "font-size: 11px;"
     add-content $report "border-top: 1px solid #999999;"
     add-content $report "border-right: 1px solid #999999;"
     add-content $report "border-bottom: 1px solid #999999;"
     add-content $report "border-left: 1px solid #999999;"
     add-content $report "padding-top: 0px;"
     add-content $report "padding-right: 0px;"
     add-content $report "padding-bottom: 0px;"
     add-content $report "padding-left: 0px;"
     add-content $report "}"
     add-content $report "body {"
     add-content $report "margin-left: 5px;"
     add-content $report "margin-top: 5px;"
     add-content $report "margin-right: 0px;"
     add-content $report "margin-bottom: 10px;"
     add-content $report ""
     add-content $report "table {"
     add-content $report "border: thin solid #000000;"
     add-content $report "}"
     add-content $report "-->"
     add-content $report "</style>"
     Add-Content $report "</head>"
     Add-Content $report "<body>"
     add-content $report "<table width='100%'>"
     add-content $report "<tr bgcolor='#CCCCCC'>"
     add-content $report "<td colspan='7' height='25' align='left'>"
     add-content $report "<font face='tahoma' color='#003399' size='4'><strong>Server: $s</strong></font>"
     add-content $report "</td>"
     add-content $report "</tr>"
     add-content $report "</table>"

     add-content $report "<table width='100%'>"
     Add-Content $report "<tr bgcolor=#CCCCCC>"
     Add-Content $report "<td width='10%' align='center'>Time</td>"
     Add-Content $report "<td width='10%' align='center'>Event Type</td>"
     Add-Content $report "<td width='10%' align='center'>Source</td>"
     Add-Content $report "<td width='70%' align='left'>Message</td>"
     Add-Content $report "</tr>"

    For ($count = 0; $count -lt $countarr;$count++)
    {
      write-host "`nCollecting" $eventlogs[$count] "Event Logs from Computer $s" -foregroundcolor yellow -backgroundcolor black
      $logs = get-eventlog -after $yesterday -logname $eventlogs[$count] -computername $s
      Write-host "Processing" -foregroundcolor yellow -backgroundcolor black

      Foreach ($l in $logs)
      {
    $time = $l.timegenerated
    $Entrytype = $l.entrytype
    $Source = $l.source
    $Message = $l.message
     
      if ($entrytype -eq "Error")
    {
      Add-Content $report "<tr>"
      Add-Content $report "<td bgcolor='#FF0000' align=center>$time</td>"
      Add-Content $report "<td bgcolor='#FF0000' align=center>$entrytype</td>"
      Add-Content $report "<td bgcolor='#FF0000' align=center>$source</td>"
      Add-Content $report "<td bgcolor='#FF0000' align=left>$Message</td>"
      Add-Content $report "</tr>"
    }
      
      if ($entrytype -eq "Warning")
    {
      
      Add-Content $report "<tr>"
      Add-Content $report "<td bgcolor='#FFF000' align=center>$time</td>"
      Add-Content $report "<td bgcolor='#FFF000' align=center>$entrytype</td>"
      Add-Content $report "<td bgcolor='#FFF000' align=center>$source</td>"
      Add-Content $report "<td bgcolor='#FFF000' align=left>$Message</td>"
      Add-Content $report "</tr>"
    }
      }
    }
    Add-content $report "</table>"
    Add-Content $report "</body>"
    Add-Content $report "</html>"
    }


    • Moved by Bill_Stewart Wednesday, December 12, 2018 5:01 PM This is not "debug/fix/rewrite my script for me" forum
    Monday, August 13, 2018 4:56 PM

All replies

  • Change this:

    For ($count = 0; $count -lt $countarr;$count++)
    {
      write-host "`nCollecting" $eventlogs[$count] "Event Logs from Computer $s" -foregroundcolor yellow -backgroundcolor black
      $logs = get-eventlog -after $yesterday -logname $eventlogs[$count] -computername $s
      Write-host "Processing" -foregroundcolor yellow -backgroundcolor black

    To this:

    $filter = @{
        Logname = 'Application','System'
        StartTime = [datetime]::Today.AddDays(-1)
    }
    $logs = Get-Content $serverlistinput |
        ForEach-Object{
            Get-WinEvent -FilterHashTable $filter -computername $_
        }

    Remove this line from script:

    $ErrorActionPreference = "silentlycontinue"

    Get the output working without HTML then use "ConvertTo-Html" to create the HTML.

    I see you will need to learn a bit more about PowerShell and programming to understand how this is done in PowerShell.

    Look in Gallery for many scripts that do what you are trying to do.


    \_(ツ)_/


    • Edited by jrv Monday, August 13, 2018 8:14 PM
    Monday, August 13, 2018 5:11 PM
  • Thank you for quick reply. Ok since you can already see i am no master at powerhell now i have another issue with this code. I replaced what you told me and removed the other line but next line now has an error.


    Missing '=' operator after key in hash literal.
    At :78 char:12
    +   Foreach ( <<<< $l in $logs)
        + CategoryInfo          : ParserError: (:) [], ParseException
        + FullyQualifiedErrorId : MissingEqualsInHashLiteral

    Monday, August 13, 2018 7:32 PM
  • You don't need the foreach.

    We do HTML like this:

    $filter = @{
        Logname = 'Application','System'
        StartTime = [datetime]::Today.AddDays(-1)
    }
    $html = Get-Content $serverlistinput |
        ForEach-Object{
            Get-WinEvent -FilterHashTable $filter -computername $_
        } |
        select TimeGenerated, Source, EntryType, Message |
        ConvertTo-Html

    See: http://tech-comments.blogspot.com/2012/07/powershell-dynamically-color-posh.html

    There are also many examples of this in the Gallery.


    \_(ツ)_/


    • Edited by jrv Monday, August 13, 2018 8:14 PM
    Monday, August 13, 2018 8:14 PM
  • Unless you know how to do the CSS for the table the "Message" portion will always be damaged when displayed.

    The CSS can be specified on the Convert" and it will format the table.


    \_(ツ)_/

    Monday, August 13, 2018 8:16 PM