{"id":1114,"date":"2009-02-03T08:00:09","date_gmt":"2009-02-03T16:00:09","guid":{"rendered":"http:\/\/www.sapien.com\/blog\/2009\/02\/03\/february-powershell-one-liner\/"},"modified":"2009-02-03T08:00:09","modified_gmt":"2009-02-03T16:00:09","slug":"february-powershell-one-liner","status":"publish","type":"post","link":"https:\/\/dev.sapien.com\/blog\/2009\/02\/03\/february-powershell-one-liner\/","title":{"rendered":"February PowerShell One-Liner"},"content":{"rendered":"

If you subscribe to the SAPIEN newsletter you should have seen this already. If not, why don’t you take a moment to subscribe? Create an account at my.SAPIEN.com<\/a> and you’ll automatically be subscribed. Each month you’ll get all the latest product and training news from SAPIEN Technologies as well as useful tips like this Powershell one-liner that produces a report on event log sizes for multiple computers.<\/p>\n

This is a single line PowerShell expression, although you could easily insert it into a script file to save some typing. I’ve inserted line breaks using the escape character (`) to make this easier to read.<\/p>\n

\n
\n
Get-Content c:\\computers.txt  | where {($_.Trim()).length -gt<\/span> 0} | foreach<\/span> { <\/pre>\n
 Get-WmiObject Win32_NTEventLogFile -computer $_.Trim() `<\/pre>\n
 -filter<\/span> \"NumberOfRecords > 0\"<\/span> | Select-Object `<\/pre>\n
 @{Name=\"Computername\"<\/span>;Expression={$_.CSName}},LogFileName,NumberOfRecords,`<\/pre>\n
 @{Name=\"Size(KB)\"<\/span>;Expression={$_.FileSize\/1kb}},`<\/pre>\n
 @{Name=\"MaxSize(KB)\"<\/span>;Expression={($_.MaxFileSize\/1KB) -as [int]}}, `<\/pre>\n
 @{name=\"PercentUsed\"<\/span>;Expression={\"{0:P2}\"<\/span> -f ($_.filesize\/$_.maxFileSize)}}<\/pre>\n
} |  Sort Computername  | Format-Table -GroupBy Computername `<\/pre>\n
-property LogFileName,NumberOfRecords,*Size*,PercentUsed<\/pre>\n
 <\/pre>\n<\/div>\n<\/div>\n
This expression will go through all the computer names in C:\\computers.txt. Each string is validated by Where-Object<\/strong> which strips out any surrounding spaces and only sends on strings with a length greater than 0.  This weeds out blank lines. Each computer name is then passed to ForEach-Object<\/strong> which uses Get-WmiObject<\/strong> to query the Win32_NTEventLogFile, looking for event logs with more than 0 entries. <\/p>\n
\"feb09OneLinerCapture\"<\/a>Each event log is then passed to Select-Object<\/strong> which creates a custom object for the computer, defining properties for name, size and maximum size in KB and a percentage used. These results are piped to Sort-object<\/strong> which sorts on the computername<\/em> property. Finally output is piped to Format-Table<\/strong> which groups the output by computername<\/em> and prepares a formatted report. <\/p>\n
I ended the expression by creating a report, which you could have further sent to a file using Out-File<\/strong> or directly to a printer using Out-Printer<\/strong>. Or perhaps instead of a formatted report, you could have created an HTML report using ConvertTo-HTML<\/strong>. The point is that PowerShell’s pipeline is flexible and versatile.<\/p>\n
If you are new to PowerShell looking for a resource, take a look at Windows PowerShell v1.0: TFM 2nd Edition<\/a>. Also keep an eye on the blog for announcements regarding PowerShell training this year. Finally, if you need help with this one-liner or any PowerShell question, please join the discussion at ScriptingAnswers.com<\/a>.<\/p>\n<\/p>\n
\n
If you want to try this one-liner out, download it here.<\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
If you subscribe to the SAPIEN newsletter you should have seen this already. If not, why don’t you take a moment to subscribe? Each month you’ll get all the latest product and training news from SAPIEN Technologies as well as useful tips like this Powershell one-liner that produces a report on event log sizes for multiple computers.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[283,25],"tags":[65,403,249,28,35],"class_list":["post-1114","post","type-post","status-publish","format-standard","hentry","category-howto","category-windows-powershell","tag-automation","tag-eventlog","tag-get-wmiobject","tag-powershell","tag-wmi"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/1114","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/comments?post=1114"}],"version-history":[{"count":0,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/1114\/revisions"}],"wp:attachment":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/media?parent=1114"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/categories?post=1114"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/tags?post=1114"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}