none
Get-WinEvent formatting conundrum RRS feed

  • Question

  • Hi All

    I monitor a number of servers which I manage, by extracting the event logs each morning.  I do have a working script using get-eventlog, which retrieves only errors and warnings for the past 24 hours, and e-mails the logs to myself.  This method has worked perfectly for several years now.  I now wish to redesign the script using get-winevent.

    Now I have noticed a few differences in the way each cmdlet works, as well as the different syntax to be used.  I have created the functions, and appears to be working as expected.  However, my OCD is starting to kick in, causing me some headaches.

    When the function completes, it e-mails the results, but the columns is all messed up in Outlook, whereas it appears fine in ISE.  Here is the function I have so far:

    Function SystemLog {
        foreach ($Server in $SRV) {
            $HT = @{
                LogName = 'System';
                StartTime = $Yesterday = (get-Date) - (new-TimeSpan -Day 1);
                }
            
            $MessageParameters = @{                        
                        Subject = "$Server System Event log - $((Get-Date).ToShortDateString())"                        
                        Body = Get-WinEvent -ComputerName $Server -FilterHashtable $HT | 
                                Where-Object {$_.LevelDisplayName -eq 'Error' -or $_.LevelDisplayName -eq 'Warning'} |
                                Format-table -Wrap |
                                Out-String
                        From = "abc@local"                        
                        To = "abc@local"                        
                        SmtpServer = "smtp.local"                        
                    }                        
                    Send-MailMessage @messageParameters 
            }
    }



    In ISE the results are fine, within the appropriate columns, but when it e-mails it, I get the following:

       ProviderName: Microsoft-Windows-WindowsUpdateClient

     

    TimeCreated                     Id LevelDisplayName Message                                                                                                                                                   

    -----------                     -- ---------------- -------                                                                                                                                                   

    01/10/2015 07:00:29             16 Warning          Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set  

                                                        schedule. Windows will continue to try to establish a connection.                                                                                        

    As you can see, this makes difficult reading, where a longer message wraps back to the beginning of the following line.  I want it to be contained\formatted under the appropriate column headers.  Now some might say it is due to me using ft -wrap, but sadly happens with or without it. 

    I also tried to pipe this into the ConvertTo-Html cmdlet, but come across a different issue (result below):

    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

    <html xmlns="http://www.w3.org/1999/xhtml">

    <head>

    <title>HTML TABLE</title>

    </head><body>

    <table>

    <colgroup><col/><col/><col/><col/><col/><col/></colgroup>

    <tr><th>ClassId2e4f51ef21dd47e99d3c952918aff9cd</th><th>pageHeaderEntry</th><th>pageFooterEntry</th><th>autosizeInfo</th><th>shapeInfo</th><th>groupingEntry</th></tr>

    <tr><td>033ecb2bc07a4d43b5ef94ed5a35d280</td><td></td><td></td><td></td><td>Microsoft.PowerShell.Commands.Internal.Format.TableHeaderInfo</td><td></td></tr>

    <tr><td>9e210fe47d09416682b841769c78b8a3</td><td></td><td></td><td></td><td></td><td>Microsoft.PowerShell.Commands.Internal.Format.GroupingEntry</td></tr>

    <tr><td>27c87ef9bbda4f709f6b4002fa4af63c</td><td></td><td></td><td></td><td></td><td></td></tr>

    <tr><td>4ec4f0187cb04f4cb6973460dfe252df</td><td></td><td></td><td></td><td></td><td></td></tr>

    <tr><td>cf522b78d86c486691226b40aa69e95c</td><td></td><td></td><td></td><td></td><td></td></tr>

    </table>

    </body></html>

    Any tips or trick I could try and resolve this?  Why is the formatting different from ISE and e-mail?  All I want is for the results to be neatly formatted in the e-mail received.

    Cheers

    Leo

    Thursday, October 1, 2015 12:38 PM

Answers

  • You cannot output to emails without using HTML or formatting your text for the email body.

    Here is an example of how to approach an email.

    Function SystemLog {
    	$HT = @{
    		LogName = 'System'
    		StartTime = $Yesterday = (get-Date) - (new-TimeSpan -Day 1)
    		Level = 2, 3
    	}
    	
    	$header = '<style type="text\css">table td{border-style: solid; border: border-collapse;}</style>'
    	$MessageParameters = @{
    		From = "abc@local"
    		To = "abc@local"
    		SmtpServer = "smtp.local"
    		BodyAsHtml=$true
    	}
    	
    	foreach ($Server in $SRV) {
    		$Body = Get-WinEvent -ComputerName $Server -FilterHashtable $HT |
    				select Server, ID, LevelDisplayName,Message |
    				ConvertTo-Html -Head $header | Out-String
    		$Subject = "$Server System Event log - $((Get-Date).ToShortDateString())"
    		Send-MailMessage @messageParameters -Body $Body -Subject $subject
    	}
    }

    To test the output return the body or write it to a file and view in IE.  Alter the $header until the style is what you like.

    To use email you  need to know more PowerShell, HTML, CSS and email technologies.  It iss a good learning exercise.


    \_(ツ)_/




    • Edited by jrv Thursday, October 1, 2015 7:09 PM
    • Marked as answer by leo246 Friday, October 2, 2015 7:09 AM
    Thursday, October 1, 2015 7:02 PM
  • Also note that you cannot pipe the output of Format-Table to ConvertTo-Html.  You can see the results.


    \_(ツ)_/

    • Marked as answer by leo246 Friday, October 2, 2015 7:10 AM
    Thursday, October 1, 2015 7:03 PM

All replies

  • If you want to send the message as HTML, then you need to tell the Send-MailMessage cmdlet that.


    PS C:\> help Send-MailMessage

    Note that there is a -BodyAsHtml parameter.


    -- Bill Stewart [Bill_Stewart]

    Thursday, October 1, 2015 1:52 PM
    Moderator
  • True, and I have done that, but no luck.  Strange that my current working script is set to send-mailmessage with -bodyashtml parameter, and I thought it will work same with new version of the script.

    Leo

    Thursday, October 1, 2015 2:14 PM
  • Sorry; I can't reproduce your problem.

    I recommend starting with a very small script that contains only the absolute minimum amount of code needed to reproduce the problem.


    -- Bill Stewart [Bill_Stewart]

    Thursday, October 1, 2015 2:16 PM
    Moderator
  • You cannot output to emails without using HTML or formatting your text for the email body.

    Here is an example of how to approach an email.

    Function SystemLog {
    	$HT = @{
    		LogName = 'System'
    		StartTime = $Yesterday = (get-Date) - (new-TimeSpan -Day 1)
    		Level = 2, 3
    	}
    	
    	$header = '<style type="text\css">table td{border-style: solid; border: border-collapse;}</style>'
    	$MessageParameters = @{
    		From = "abc@local"
    		To = "abc@local"
    		SmtpServer = "smtp.local"
    		BodyAsHtml=$true
    	}
    	
    	foreach ($Server in $SRV) {
    		$Body = Get-WinEvent -ComputerName $Server -FilterHashtable $HT |
    				select Server, ID, LevelDisplayName,Message |
    				ConvertTo-Html -Head $header | Out-String
    		$Subject = "$Server System Event log - $((Get-Date).ToShortDateString())"
    		Send-MailMessage @messageParameters -Body $Body -Subject $subject
    	}
    }

    To test the output return the body or write it to a file and view in IE.  Alter the $header until the style is what you like.

    To use email you  need to know more PowerShell, HTML, CSS and email technologies.  It iss a good learning exercise.


    \_(ツ)_/




    • Edited by jrv Thursday, October 1, 2015 7:09 PM
    • Marked as answer by leo246 Friday, October 2, 2015 7:09 AM
    Thursday, October 1, 2015 7:02 PM
  • Also note that you cannot pipe the output of Format-Table to ConvertTo-Html.  You can see the results.


    \_(ツ)_/

    • Marked as answer by leo246 Friday, October 2, 2015 7:10 AM
    Thursday, October 1, 2015 7:03 PM
  • Thanks jrv!

    I forgot the caveat about Format-table.  I have now piped the results to ConvertTo-Html, and then piped to Format-table, which gives me a better result.

    I'll spend some time reading up on HTML and CSS subjects.

    Cheers

    Leo

    Friday, October 2, 2015 7:09 AM
  • Sorry but you cannot pipe Convert to Html to Format-Table.  It will produce more junk.

    Don't worry.  You will figure it out one day.


    \_(ツ)_/

    Friday, October 2, 2015 7:48 AM
  • Thanks, and so I learn something new today :)  Still finding my feet with powershell.

    Again, thank you very much for the tips.

    Leo

    Friday, October 2, 2015 8:37 AM