Hi Team,
I tried to group the event IDs reported on my application logs using following command -
get-winevent -logname "Application" | select id, Message | group-object id
I am facing a challenge that the proproty called "Message" contains sub properties. Following is the output of get-winevent command -
-------------------------------------------------------------------------
Message : Timestamp: 15-05-2013 07:03:20
Message: Event Description : ""
GetAdvertisementMappings threw Exception: Object reference not set to an instance of an object.
Category: General
Priority: -1
EventId: 1021
Severity: Error
Title:Staging
Machine: server0123.mydomain.com
Application Domain: /LM/W3SVC/3654621232/ROOT-1-165356734564
Process Id: 10552
Process Name: c:\windows\system32\inetsrv\w3wp.exe
Win32 Thread Id: 9080
Thread Name:
Extended Properties: Request URL -http://test1.staging.ext/Pages/default.aspx
WebUserIP - 10.14.101.9
Current Culture - en-IN
Current UI Culture - en-IN
Id : 1021
Version :
Qualifiers : 0
Level : 2
Task : 0
Opcode :
Keywords : 36028797018963968
RecordId : 3408984
ProviderName : Enterprise Library Logging
ProviderId :
LogName : Application
ProcessId :
ThreadId :
MachineName : server0123.mydomain.com
UserId :
TimeCreated : 5/15/2013 7:03:20 AM
ActivityId :
RelatedActivityId :
ContainerLog : application
MatchedQueryIds : {}
Bookmark : System.Diagnostics.Eventing.Reader.EventBookmark
LevelDisplayName : Error
OpcodeDisplayName : Info
TaskDisplayName :
KeywordsDisplayNames : {Classic}
Properties : {System.Diagnostics.Eventing.Reader.EventProperty}
-------------------------------------------------------------------------
I am looking to include the description of the event ids in my report but it does not appear correctly -
Count Name Group
----- ---- -----
1150 2319 {@{Id=2319; Message=Timestamp: 15/05/2013 6:53:38 AM...
488 1000 {@{Id=1000; Message=Performance counters for the WmiApRpl (WmiApRpl) service were lo...
2 1001 {@{Id=1001; Message=Performance counters for the WmiApRpl (WmiApRpl) service were re...
5588 7024 {@{Id=7024; Message=Timestamp: 15-05-2013 06:52:39...
2452 2009 {@{Id=2009; Message=Timestamp: 15/05/2013 6:51:49 AM...
1452 256 {@{Id=256; Message=The "vmStatsProvider" is successfully initialized for this Virtua...
678 2000 {@{Id=2000; Message=Timestamp: 15/05/2013 6:45:33 AM...
219 1007 {@{Id=1007; Message=Timestamp: 15/05/2013 6:41:15 AM...
267 1032 {@{Id=1032; Message=Timestamp: 15/05/2013 6:41:15 AM...
745 1002 {@{Id=1002; Message=Timestamp: 15/05/2013 6:41:15 AM...
130 1010 {@{Id=1010; Message=Timestamp: 15/05/2013 6:39:32...
382 1015 {@{Id=1015; Message=Timestamp: 15/05/2013 6:38:09 AM...
657 1315 {@{Id=1315; Message=Event code: 4005 ...
116 1021 {@{Id=1021; Message=Timestamp: 15/05/2013 6:36:15 AM...
Please suggest how to improve the report.
Thanks
Charlie
Charlie