I highly suggest that if you are entertaining the idea of using call LogParser within PowerShell, you should copy David Muegge’s LogParser library into your code base. Check out his posting for an explanation on how his library works (it is slick).
function Get-ExchangeEventLogRecords {
# Include our LogParser library
# Check out David Muegge's Blog
# http://muegge.com/blog/?p=65
# for more info on his library
.\LogParser_Lib.ps1
# This is the query we will be passing
# to LogParser
# Let's hear it for Here-Strings!
$query = @"
SELECT ComputerName, timewritten, Message
FROM \\Exchange01\application
WHERE eventID = 1221 and
SourceName = 'MSExchangeIS Mailbox Store' and
to_date(timewritten) = System_Date()
"@
$inputformat = Get-LPInputFormat "evt"
$records = Get-LPRecordSet $query $inputformat
return $records
}
The function Get-ExchangeEventLogRecords returns all the records that I care about (in this example I have included only one Exchange Server). In order to get the exact fields I want, I need to parse the Message field from the event log. The field looks something like this:
The database "MSXC01SG4\MSXC01SG4DB4" has 4626 megabytes of free space after online defragmentation has terminated…
The next function takes care of the parsing and creates a custom object for me.
function Format-ExchangeEventLogObject {
Begin {
$regex = [regex] '(?:MSXC\w+\\MSXC\w+)'
$regex1 = [regex] '(?:\s\d+)' }
Process {
$Store = $regex.Match($_.message) | select Value
$Mem = $regex1.Match($_.message) | select Value
$Mem = $Mem.value.ToString().Trim()
$obj = New-Object psObject
$obj | Add-Member NoteProperty TimeWritten $_.TimeWritten
$obj | Add-Member NoteProperty ExchangeServer $_.ComputerName
$obj | Add-Member NoteProperty Store $Store.Value
$obj | Add-Member NoteProperty AvailableMem $Mem
Write-Output $obj }
}
One thing to note, so far, we have only looked at the available space within the *.EDB file. In the next post, I will take this information and gather a few more relevant fields (total size of the EDB file, size of STM file, estimated availability in the STM file) and show a graphical representation of the data.
Enjoy!
