Asked by:
Why is my log Truncated for event log export

Question
-
Hello,
Not sure if some one has posted something like this, but i just need to see where i can tell why is my list getting truncated once there is too many events. Sometimes i get all of the servers in the list and other just some. Code is listed below. I have omitted 2 lines that show where the file is exported. and import of server list.
cls
$ErrorActionPreference = "silentlycontinue"
$serverlistinput = "\Servers.txt"
$datetime = Get-Date -Format "yyyyMMdd";
$today = Get-Date
$yesterday = $today.AddHours(-24)
$serverlist = Get-Content $serverlistinput
$reportpath = "EventLogs"
$report = $reportpath + "\Server-Logs-$datetime.htm"
Clear-Content $report
[array]$eventlogs = $null
$eventlogs += "Application"
$Eventlogs += "System"
$countarr = $eventlogs.count
Foreach ($s in $serverlist)
{
Add-Content $report "<html>"
Add-Content $report "<head>"
Add-Content $report "<meta http-equiv='Content-Type' content='text/html; charset=iso-8859-1'>"
Add-Content $report '<title>Event Log Report</title>'
add-content $report '<STYLE TYPE="text/css">'
add-content $report "<!--"
add-content $report "td {"
add-content $report "font-family: Tahoma;"
add-content $report "font-size: 11px;"
add-content $report "border-top: 1px solid #999999;"
add-content $report "border-right: 1px solid #999999;"
add-content $report "border-bottom: 1px solid #999999;"
add-content $report "border-left: 1px solid #999999;"
add-content $report "padding-top: 0px;"
add-content $report "padding-right: 0px;"
add-content $report "padding-bottom: 0px;"
add-content $report "padding-left: 0px;"
add-content $report "}"
add-content $report "body {"
add-content $report "margin-left: 5px;"
add-content $report "margin-top: 5px;"
add-content $report "margin-right: 0px;"
add-content $report "margin-bottom: 10px;"
add-content $report ""
add-content $report "table {"
add-content $report "border: thin solid #000000;"
add-content $report "}"
add-content $report "-->"
add-content $report "</style>"
Add-Content $report "</head>"
Add-Content $report "<body>"
add-content $report "<table width='100%'>"
add-content $report "<tr bgcolor='#CCCCCC'>"
add-content $report "<td colspan='7' height='25' align='left'>"
add-content $report "<font face='tahoma' color='#003399' size='4'><strong>Server: $s</strong></font>"
add-content $report "</td>"
add-content $report "</tr>"
add-content $report "</table>"
add-content $report "<table width='100%'>"
Add-Content $report "<tr bgcolor=#CCCCCC>"
Add-Content $report "<td width='10%' align='center'>Time</td>"
Add-Content $report "<td width='10%' align='center'>Event Type</td>"
Add-Content $report "<td width='10%' align='center'>Source</td>"
Add-Content $report "<td width='70%' align='left'>Message</td>"
Add-Content $report "</tr>"
For ($count = 0; $count -lt $countarr;$count++)
{
write-host "`nCollecting" $eventlogs[$count] "Event Logs from Computer $s" -foregroundcolor yellow -backgroundcolor black
$logs = get-eventlog -after $yesterday -logname $eventlogs[$count] -computername $s
Write-host "Processing" -foregroundcolor yellow -backgroundcolor black
Foreach ($l in $logs)
{
$time = $l.timegenerated
$Entrytype = $l.entrytype
$Source = $l.source
$Message = $l.message
if ($entrytype -eq "Error")
{
Add-Content $report "<tr>"
Add-Content $report "<td bgcolor='#FF0000' align=center>$time</td>"
Add-Content $report "<td bgcolor='#FF0000' align=center>$entrytype</td>"
Add-Content $report "<td bgcolor='#FF0000' align=center>$source</td>"
Add-Content $report "<td bgcolor='#FF0000' align=left>$Message</td>"
Add-Content $report "</tr>"
}
if ($entrytype -eq "Warning")
{
Add-Content $report "<tr>"
Add-Content $report "<td bgcolor='#FFF000' align=center>$time</td>"
Add-Content $report "<td bgcolor='#FFF000' align=center>$entrytype</td>"
Add-Content $report "<td bgcolor='#FFF000' align=center>$source</td>"
Add-Content $report "<td bgcolor='#FFF000' align=left>$Message</td>"
Add-Content $report "</tr>"
}
}
}
Add-content $report "</table>"
Add-Content $report "</body>"
Add-Content $report "</html>"
}
- Moved by Bill_Stewart Wednesday, December 12, 2018 5:01 PM This is not "debug/fix/rewrite my script for me" forum
Monday, August 13, 2018 4:56 PM
All replies
-
Change this:
For ($count = 0; $count -lt $countarr;$count++)
{
write-host "`nCollecting" $eventlogs[$count] "Event Logs from Computer $s" -foregroundcolor yellow -backgroundcolor black
$logs = get-eventlog -after $yesterday -logname $eventlogs[$count] -computername $s
Write-host "Processing" -foregroundcolor yellow -backgroundcolor blackTo this:
$filter = @{ Logname = 'Application','System' StartTime = [datetime]::Today.AddDays(-1) } $logs = Get-Content $serverlistinput | ForEach-Object{ Get-WinEvent -FilterHashTable $filter -computername $_ }
Remove this line from script:
$ErrorActionPreference = "silentlycontinue"
Get the output working without HTML then use "ConvertTo-Html" to create the HTML.
I see you will need to learn a bit more about PowerShell and programming to understand how this is done in PowerShell.
Look in Gallery for many scripts that do what you are trying to do.
\_(ツ)_/
- Edited by jrv Monday, August 13, 2018 8:14 PM
Monday, August 13, 2018 5:11 PM -
Thank you for quick reply. Ok since you can already see i am no master at powerhell now i have another issue with this code. I replaced what you told me and removed the other line but next line now has an error.
Missing '=' operator after key in hash literal.
At :78 char:12
+ Foreach ( <<<< $l in $logs)
+ CategoryInfo : ParserError: (:) [], ParseException
+ FullyQualifiedErrorId : MissingEqualsInHashLiteralMonday, August 13, 2018 7:32 PM -
You don't need the foreach.
We do HTML like this:
$filter = @{ Logname = 'Application','System' StartTime = [datetime]::Today.AddDays(-1) } $html = Get-Content $serverlistinput | ForEach-Object{ Get-WinEvent -FilterHashTable $filter -computername $_ } | select TimeGenerated, Source, EntryType, Message | ConvertTo-Html
See: http://tech-comments.blogspot.com/2012/07/powershell-dynamically-color-posh.html
There are also many examples of this in the Gallery.
\_(ツ)_/
- Edited by jrv Monday, August 13, 2018 8:14 PM
Monday, August 13, 2018 8:14 PM -
Unless you know how to do the CSS for the table the "Message" portion will always be damaged when displayed.
The CSS can be specified on the Convert" and it will format the table.
\_(ツ)_/
Monday, August 13, 2018 8:16 PM