Get-GphDfslog.ps1
|
function Get-GphDfslog { #todo: DFS Log examples <# .SYNOPSIS Returns the DFS Log. .DESCRIPTION This funtions reads the last successful Group Policy Run from the Registry. You can chose between Machine- and User History. .EXAMPLE .NOTES Author: Holger Voges Date: 2018-11-16 Version: 1.0 #> param( # ValidateScript [parameter(Mandatory=$false)] $DFSLogFile = (Get-ChildItem (Get-WmiObject -Namespace root\microsoftdfs -Class DfsrMachineConfig).DebugLogFilePath | Where-Object { $_.fullname -match "\S\\dfsr[\d]{5}.log$" }).Fullname ) $pattern1 = '(\d{8})\s(\d{2}:\d{2}:\d{2}.\d{3})\s(\d{1,5})\s(\w{4})\s{1,3}(\d{1,5})\s([\s\S]{1,}?)::([\s\S]{1,})' $pattern2 = '(\d{8})\s(\d{2}:\d{2}:\d{2}.\d{3})\s(\d{4,5})\s(\w{4})\s{1,3}(\d{1,4})\s(\[(WARN|ERROR)])\s([\s\S]{1,}?)::([\s\S]{1,})' $pattern3 = '(\d{8})\s(\d{2}:\d{2}:\d{2}.\d{3})\s(\d{1,5})\s(\w{4})\s{1,5}(\d{1,5})\s([\s\S]{1,}?)\s([\s\S]{1,})' $DFSLog = Get-Content -ReadCount 0 -Path $DFSLogFile -Encoding UTF8 # $dfslog = $DFSlog.Replace("`n`r`n","`r`n") for ( $i = 0; $i -lt $DFSLog.Length; $i++) { # Write-Progress -Activity 'Importing DFS-Log' -PercentComplete ( ($i*100)/$DFSLog.Count ) -CurrentOperation 'Processing Log Entries' $LogEntry = 1 | Select-Object LineCount,Date,Time,Thread,Source,Line,EntryType,Method,Data Switch ( $DFSLog[$i] ) { { $_ -match $pattern2; $global:out = $matches } { $LogEntry.LineCount = $i $LogEntry.Date = $out[1] $LogEntry.Time = $out[2] $LogEntry.Thread = $out[3] $LogEntry.Source = $out[4] $LogEntry.Line = $out[5] $LogEntry.EntryType = $out[6] $logEntry.Method = $out[8] $LogEntry.Data = $out[9] Continue } { $_ -match $pattern1; $global:out = $matches } { $LogEntry.LineCount = $i $LogEntry.Date = $out[1] $LogEntry.Time = $out[2] $LogEntry.Thread = $out[3] $LogEntry.Source = $out[4] $LogEntry.Line = $out[5] $logEntry.Method = $out[6] $LogEntry.Data = $out[7] Continue } { $_ -match $pattern3; $global:out = $matches } { $LogEntry.LineCount = $i $LogEntry.Date = $out[1] $LogEntry.Time = $out[2] $LogEntry.Thread = $out[3] $LogEntry.Source = $out[4] $LogEntry.Line = $out[5] $logEntry.Method = $out[6] $LogEntry.Data = $out[7] Continue } default { $LogEntry.Data = $DfsLog[$i] } } $LogEntry } } |