Monthly Archive September 27, 2017

#powershell One-liner Code: Event Logs Overview

One liner #powershell code to list the frequency of most recent events generated for the specified EventViewer log file type.

( can you spot an “error”? )
Get-EventLog -ComputerName (hostname) -LogName system |
Group-Object EntryType |
% `
-Begin { "-begin '$($_.name)'" } `
-Process {
"-process '$($_.name)'";
$_.group | group EventId |
sort count -desc |
select count, name,
@{l='TimeGenerated';e={$_.group[0].TimeGenerated}},
@{l='Message';e={$_.group[0].Message}}} |
ft -au

#skype4b #powershell Event ID and Provider “Crash” (Source)

Certain third party software programs may use the same Event ID to write entries in the Application event log. An example is Event ID 10 used by the source “Verba System Monitor” (now part of Actiance) which crashes with information logged by Windows system providers like WMI.

Hence, when gathering logs with Get-EventLog and Get-WinEvent, remember to check not just the Event ID but also that of the Provider (Source).

Actiance Vantage and/or Verba are software applications typically deployed in a Skype for Business environment where ethical firewalls are erected for the purpose of segregating communications between (internal) business units.

#powerShell Inhibit Output Echo from ArrayList Method

For optimal performance, creation of an empty array using
$a = New-Object System.Collections.ArrayList

is, for instance, preferred over
$a = @()

However, putting a single element into the array with the former’s Add() method will auto output the index of the just inserted item. If left unchecked, this can become part of the output in a PowerShell function call which may not be desirable.

To resolve this, simply pipe the call to Out-Null like
$a.Add((Get-Date)) | Out-Null

or prefix with [void] to suppress the echo:
[void]$a.Add((Get-Date))

#powershell Write-Progress Suppress Status Bar Display

By default with the Write-Progress cmdlet,

$ProgressPreference -eq “Continue”   #$true

where the progress bar display (status) in a Windows PowerShell command window can be suppressed with

$ProgressPreference = “SilentlyContinue”

Note that this setting apparently works only in a regular remote RDP session but not over a PS Remoting session, a fact that the official documentation does not mention.

Hence, Write-Verbose or Write-Host may be your only options to provide a visual status indication.

#powershell Your Own PsDrive to ../drivers/etc Folder

New-PSDrive -PSProvider FileSystem -Name etc -Root $env:windir/system32/drivers/etc
#Usage: cd etc:

#powershell Search For Text in Multiple Files/Folders

dir *.ps1,*.txt -recurse | % {
Write-Verbose $PsItem.Fullname -verbose; gc $PsItem.Fullname |
sls 'Remove' -Context 2,3 }