LogParser output and Powershell

Question

I am using the below PowerShell function to parse event logs that have been saved locally from a remote machine. Unfortunately, I cannot for the life of me figure out how to dump out to another format instead of just to the console window.

When I insert an INTO statement into my SQL query I get the following error:

Exception calling "Execute" with "2" argument(s): "Cannot specify an INTO-entity when calling Execute() [The parameter is incorrect.]"

Any help is greatly appreciated.

    Function Parse-Event-Logs
{

$logtypes = "Application","System","Security"
foreach ($logtype in $logtypes)
{
$log_file = $LogsArchive + "\" + $folder + "\" + $logtype + ".evt"
$log_parser = new-object -comobject MSUtil.LogQuery
$log_type = new-object -comobject MSUtil.LogQuery.EventLogInputFormat
$log_type.resolvesids = $true
$log_type.fulltext = $true
$output_type = new-object -comobject MSUtil.LogQuery.NativeOutputFormat
$log_query = "SELECT * FROM $log_file  WHERE EventTypeName = 'Error event' OR EventTypeName = 'Warning event'"

$log_recs = $log_parser.execute($log_query,$log_type)
try{
do{
$lp_return = @{}
$log_entry = $log_recs.getrecord()

$lp_return.add("Index",$log_entry.getvalue("RecordNumber"))
$lp_return.add("EntryType",$log_entry.getvalue("EventTypeName"))
$lp_return.add("EventID",$log_entry.getvalue("EventID"))
$lp_return.add("Message",$log_entry.getvalue("Message"))
$lp_return.add("Category",$log_entry.getvalue("EventCategoryName"))
$lp_return.add("CategoryNumber",$log_entry.getvalue("EventCategory"))
$lp_return.add("ReplacementStrings",$log_entry.getvalue("Strings"))
$lp_return.add("Source",$log_entry.getvalue("SourceName"))
$lp_return.add("TimeGenerated",$log_entry.getvalue("TimeGenerated"))
$lp_return.add("TimeWritten",$log_entry.getvalue("TimeWritten"))
$lp_return.add("UserName",$log_entry.getvalue("SID"))
$lp_return | new-hashobject

$log_recs.movenext()
} while ($log_recs.atend() -eq $false)
}

Catch {Write-Host "Event log is empty"}
}
}

Do you any better luck using ExecuteBatch?

Keith Hill
– Keith Hill

2010-06-23 16:57:46 +00:00
Commented Jun 23, 2010 at 16:57 — Keith Hill
– Keith Hill, Commented Jun 23, 2010 at 16:57
BTW have you seen this: muegge.com/blog/?p=65

Keith Hill
– Keith Hill

2010-06-23 16:59:58 +00:00
Commented Jun 23, 2010 at 16:59 — Keith Hill
– Keith Hill, Commented Jun 23, 2010 at 16:59
Thanks Keith, ExecuteBatch did it.

Christopher
– Christopher

2010-06-23 17:35:58 +00:00
Commented Jun 23, 2010 at 17:35 — Christopher
– Christopher, Commented Jun 23, 2010 at 17:35

Keith Hill · Accepted Answer · 2010-06-23 19:24:22Z

1

OK, converting the comment to an answer. :-)

Use the ExecuteBatch method instead of the Execute method. ExecuteBatch allows for passing in input and output types.

answered Jun 23, 2010 at 19:24

Keith Hill

204k44 gold badges370 silver badges377 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

LogParser output and Powershell

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related