Using PowerShell, LogParser and PowerGadgets to get Exchange 2003 storage information – Part 1

Was asked this week to write up a script that would graphically show how much free space was available in our Exchange Databases. My twitter colleague Alan Renouf made me aware of Jonathan Medds's post about Exchange free space. This gave me a good starting point. I now knew to look for EventID 1221 in the Exchange server(s) application event log. Being a big fan of LogParser, I decided to query the event logs using it instead of Get-WMIObject Win32_NTLogEvent.  My reasoning for this is two-fold, I have a lot of LogParser scripts that I am able to reuse in PowerShell.  Additionally, for many log parsing tasks, LogParser still is faster then using Select-String or other parsing methods. 

I highly suggest that if you are entertaining the idea of using call LogParser within PowerShell, you should copy David Muegge’s LogParser library into your code base.  Check out his posting for an explanation on how his library works (it is slick).

function Get-ExchangeEventLogRecords {

# Include our LogParser library
# Check out David Muegge's Blog
# http://muegge.com/blog/?p=65
# for more info on his library
    .\LogParser_Lib.ps1

# This is the query we will be passing
# to LogParser
# Let's hear it for Here-Strings!
$query = @"
SELECT ComputerName, timewritten, Message
FROM \\Exchange01\application
WHERE eventID = 1221 and
SourceName = 'MSExchangeIS Mailbox Store' and
to_date(timewritten) = System_Date()
"@
$inputformat = Get-LPInputFormat "evt"
$records = Get-LPRecordSet $query $inputformat
return $records
}

The function Get-ExchangeEventLogRecords returns all the records that I care about (in this example I have included only one Exchange Server). In order to get the exact fields I want, I need to parse the Message field from the event log.  The field looks something like this:

The database "MSXC01SG4\MSXC01SG4DB4" has 4626 megabytes of free space after online defragmentation has terminated…

The next function takes care of the parsing and creates a custom object for me.

function Format-ExchangeEventLogObject {
    Begin {
        $regex = [regex] '(?:MSXC\w+\\MSXC\w+)'
        $regex1 = [regex] '(?:\s\d+)' }
 
    Process {
        $Store = $regex.Match($_.message) | select Value
        $Mem = $regex1.Match($_.message) | select Value
        $Mem = $Mem.value.ToString().Trim()
        $obj = New-Object psObject
        $obj | Add-Member NoteProperty TimeWritten $_.TimeWritten
        $obj | Add-Member NoteProperty ExchangeServer $_.ComputerName
        $obj | Add-Member NoteProperty Store $Store.Value
        $obj | Add-Member NoteProperty AvailableMem $Mem
        Write-Output $obj }
}

One thing to note, so far, we have only looked at the available space within the *.EDB file.  In the next post, I will take this information and gather a few more relevant fields (total size of the EDB file, size of STM file, estimated availability in the STM file) and show a graphical representation of the data.

Enjoy!