Log4NetMonitor.ps1

# 20190319 Log4net-Monitor.ps1 # Sends a mail when a search term is logged in log4net logs. Can e.g. be run as a Scheduled Task. Logs hits to not repeatedly alert same log entries. # Understand the script before you use it. param ( [string]$AppLogFile = “C:\temp\logs\server\app.log”, [string]$SearchTerm = ”.SQLException” ) $Error.Clear() [string]$strLogFile = $PSCommandPath + ”.log” $Body = $null if ( (Test-Path $strLogFile) -eq $false ) { Set-Content -Path $strLogFile -Value “LogMonitorrn____________rn” } [boolean]$blnNewEntries = $false if ( (Test-Path $AppLogFile) -eq $false ) { Write-Error “No log file to parse, $AppLogFile was given.” } else { [string]$strAppLogFile = $AppLogFile + ”.tmp” Copy-Item $AppLogFile $strAppLogFile [string[]]$astrLogContent = ([io.file]::ReadAllText($strAppLogFile)).Replace(rn “,” “).Replace(rn([a-z,A-Z])”,” $2”) -split(rn”) -match($SearchTerm) [string[]]$astrEntriesAlreadySent = Get-Content $strLogFile for ($i = 0;$i -lt $astrLogContent.count; $i++) { [string[]]$astrRow = $astrLogContent[$i].Split(“[“) [string]$strTime = $astrRow[0].Trim() if ($strTime -in $astrEntriesAlreadySent -or $strTime -notlike '20*' ) { $astrLogContent[$i] = ”(Deleted)” } else { $blnNewEntries = $true Add-Content $strLogFile -Value $strTime } } switch ($blnNewEntries) { $true { [string]$Body = ($astrLogContent -notmatch(”(Deleted)”) | Sort-Object) -join(rn”) } $false { [string]$Body = “No new entries for search term.” } } } if ($error -ne $null) { $Body += rnrnErrorsrn” $Body += ($Error | Select-Object *) } $Body += rnrnLog entries sentrn________rn” [string[]]$astrParseLogSentWholeStory = Get-Content $strLogFile $Body += ($astrParseLogSentWholeStory -match '20*') -join(rn”) if ($blnNewEntries -or ($Error -ne $null)) { Send-MailMessage -From me@org.org -To me@org.org -Body $Body -SmtpServer 192.168.22.11 -Subject “New $SearchTerm or script error on $env:COMPUTERNAME in $AppLogFile” }