Powershell Script Not Pulling Event from Event Log

Question

Breaking my brian here trying to figure out why this won't pull events from the event log?

I am seeing the event in the event log with the message "The backup operation has completed."

The Event ID is: 14 located under Log Name: Microsoft-Windows-Backup/Operational

$PastHours = 24

$StartAt = (Get-Date).AddHours(-$PastHours)
$ErrorActionPreference = "SilentlyContinue"

$FilterHashTable = @{
    logname   = "Microsoft-Windows-Backup/Operational"
    id        = 14
    StartTime = $StartAt
}

$actions = (Get-WinEvent -FilterHashtable $FilterHashTable | 
    Where-Object {($_.Message -like "*operation*")})

if ($actions){
    ForEach($action in $actions){
        $Result = "OK: Windows Backup Completed Successfully"
        Write-Host $Result
        Exit 0
    }
}
elseif ($action.count -eq "0") {
    $Result = "CRITICAL: Windows Backup has not run in past $PastHours hours "
    Write-Host $Result
    Exit 2
}
else {
    $Result = "CRITICAL: Windows Backup has not run in past $PastHours hours "
    Write-Host $Result
    Exit 2
}

I run the script and confirm that every time that $action.count is 0.. The event is present and was run last at 8/8/2018 2:12 PM

Any suggestions?

Can you list $actions and see if anything is there? If not, remove Where-Object and verify if that helps. At least you'll know what to troubleshoot. — Robert Dyjas
– Robert Dyjas, Commented Aug 9, 2018 at 14:37
I removed the Where-Object but still did not find the task. $actions is null - I think when I try and print it. — Roland77
– Roland77, Commented Aug 9, 2018 at 14:44
It works for me (don't have Windows Backup so I had to use another log) so I don't think I'll be able to help more. Just to confirm - are you running the script on the same machine you checked the logs? — Robert Dyjas
– Robert Dyjas, Commented Aug 9, 2018 at 14:49

Roland77 · Accepted Answer · 2018-08-10 13:33:18Z

Thanks Jacob, you're right.

It's working now using:

Param(
    [string]$PastHours
)

$StartAt = (Get-Date).AddHours(-$PastHours)
$ErrorActionPreference = "SilentlyContinue"

$FilterHashTable = @{
    logname   = "Microsoft-Windows-Backup"
    id        = 4
    StartTime = $StartAt
}

$actions = (Get-WinEvent -FilterHashtable $FilterHashTable | 
    Where-Object {($_.Message -like "*successfully*")})

if ($actions){
    ForEach($action in $actions){
        $Result = "OK: Windows Backup Completed Successfully at {1} " -F $Task,$action.TimeCreated
        Write-Host $Result
        Exit 0
    }
}
elseif ($action.count -eq "0") {
    $Result = "CRITICAL: Windows Backup has not run in past $PastHours hours"
    Write-Host $Result
    Exit 2
}
else {
    $Result = "CRITICAL: Windows Backup has not run in past $PastHours hours"
    Write-Host $Result
    Exit 2
}

Collectives™ on Stack Overflow

Powershell Script Not Pulling Event from Event Log

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related