Merge pull request #255 from Icinga:fix/eventlog_analyer_for_multi_array_result

Fix: Array handling on log analyser and adds timestamp to output

Improves `Show-IcingaEventLogAnalysis` by properly handling array logs and only processing the first entry while also adding timestamps for the newest and oldest eventog entry

Fixes #246
This commit is contained in:
Lord Hepipud 2021-05-28 21:10:02 +02:00 committed by GitHub
commit 72c1495165
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -9,7 +9,8 @@ function Show-IcingaEventLogAnalysis()
Start-IcingaTimer 'EventLog Analyser';
try {
$BasicLogData = Get-WinEvent -ListLog $LogName -ErrorAction Stop;
[array]$BasicLogArray = Get-WinEvent -ListLog $LogName -ErrorAction Stop;
$BasicLogData = $BasicLogArray[0];
} catch {
Write-IcingaConsoleError 'Failed to fetch data for EventLog "{0}". Probably this log does not exist.' -Objects $LogName;
return;
@ -40,13 +41,21 @@ function Show-IcingaEventLogAnalysis()
};
};
$LogData = Get-WinEvent -LogName $LogName;
$LogData = Get-WinEvent -LogName $LogName;
[string]$NewestEntry = $null;
[string]$OldestEntry = $null;
foreach ($entry in $LogData) {
[string]$DayOfLogging = $entry.TimeCreated.ToString('yyyy\/MM\/dd');
[string]$HourOfLogging = $entry.TimeCreated.ToString('yyyy\/MM\/dd-HH');
[string]$MinuteOfLogging = $entry.TimeCreated.ToString('yyyy\/MM\/dd-HH-mm');
$OldestEntry = $entry.TimeCreated.ToString('yyyy-MM-dd HH:mm:ss');
if ([string]::IsNullOrEmpty($NewestEntry)) {
$NewestEntry = $OldestEntry;
}
if ($LogAnalysis.Day.Entries.ContainsKey($DayOfLogging) -eq $FALSE) {
$LogAnalysis.Day.Entries.Add($DayOfLogging, 0);
}
@ -89,5 +98,7 @@ function Show-IcingaEventLogAnalysis()
Write-IcingaConsoleNotice 'Maximum Logs per Day: {0}' -Objects $LogAnalysis.Day.Maximum;
Write-IcingaConsoleNotice 'Maximum Logs per Hour: {0}' -Objects $LogAnalysis.Hour.Maximum;
Write-IcingaConsoleNotice 'Maximum Logs per Minute: {0}' -Objects $LogAnalysis.Minute.Maximum;
Write-IcingaConsoleNotice 'Newest entry timestamp: {0}' -Objects $NewestEntry;
Write-IcingaConsoleNotice 'Oldest entry timestamp: {0}' -Objects $OldestEntry;
Write-IcingaConsoleNotice 'Analysing Time: {0}s' -Objects ([math]::Round((Get-IcingaTimer 'EventLog Analyser').Elapsed.TotalSeconds, 2));
}