Powershell to pull Application Event logs with Event Id 1221

Reply

Krishna Posted: 09-01-2009 3:41 AM

rated by 0 users

Application Event ID 1221 gives the details of the white space on the Exchange Database.  With the amount of white space we can determine if we wanted to do a defrag on the store or not. Below powershell helps you to pull all the application events with id 1221 from last 2 days

$2DaysAgo = [DateTime]::Now.AddDays(-2)
$Events = Get-Eventlog Application | Where {($2DaysAgo -le $_.TimeWritten)} | ?{$_.eventid -eq “1221″}
$Events

http://smtpport25.wordpress.com/2009/08/25/powershell-to-pull-application-event-logs-with-event-id-1221/

Reply

Aleksandar replied on 09-01-2009 1:02 PM

rated by 0 users

Consider using Get-WMIObject cmdlet and class Win32_NTLogEvent with proper filter to get results much faster:

$filter = "LogFile='Application' AND EventCode=1221 AND TimeWritten>='$Start' AND TimeWritten<='$End'"

Get-WMIObject Win32_NTLogEvent -ComputerName $_.Name -Filter $filter

If you still want to use Get-EventLog, you can create one Where-Object clause:

$Events = Get-Eventlog Application | Where {$2DaysAgo -le $_.TimeWritten -and $_.eventid -eq 1221}

-aleksandar

http://powershellers.blogspot.com

Reply

Krishna replied on 09-02-2009 1:29 AM

rated by 0 users

Hi Aleksandar,

Thanks for much easier and simpler solution...

regards,
Krishna
http://smtpport25.wordpress.com