Has anyone ever run into this issue and found a fix for it?
I'm trying to run the following script (with the real proc name/schema and such) to pull the event logs for the last 6 minutes and insert them into a database for tracking purposes. This just gets me the string needed to set a variable called later and actually run the SQL.
When running this script on the server itself in PowerShell, I get output. When running this in a task in VCRON, I do not get output. Some settings/background.... If i run without the If and just use -Newest 10 (or any number) it will produce the proper output to be used in other tasks. I am executing this remotely on the server being monitored from the VCRON task. I have tried putting this in a file and running that from VCRON instead but that also did not work. I have tried using Write-Output and Write-Host instead of just $SQL, and that made no difference. I have also played around with ordering the statements differently and including the write in my "continue" IF and that still did not produce the appropriate results. Each of the aforementioned attempts did work properly when run manually by me on the server in a PowerShell window. Using the "Newest" parameter for Get-EventLog is really not ideal, so I'd like to find a way to make this work.
I have also tried using break instead of continue, and neither option works.
If I just put that $_.TimeWritten -gt ((Get-Date).AddMinutes(-6)) in the Where section of Get-EventLog or utilize the -After option it will scan the whole event log even though it only needs the last 6 minutes and that takes entirely too long.
I'm running with version 8.3.5, if that helps at all.
$sqlstatement=@'
EXECUTE SomeStoredProcedure
@Path = '{0}',
@FileCreateDate = '{1}',
@FileModifiedDate = '{2}'
'@
Get-EventLog -LogName Security -InstanceId 4656 | Select-Object TimeWritten, EventId, @{Label="FilePath";Expression={ $_.ReplacementStrings[6] -as [string] }} | Where {($_.FilePath -Like "*.trn" -or $_.FilePath -Like "*.bak") } |
ForEach-Object {
$SQL = $sqlstatement -f $_.FilePath, $_.TimeWritten, $_.TimeWritten
$SQL
if ($_.TimeWritten -lt ((Get-Date).AddMinutes(-6))) {
Continue}
}
Any assistance is greatly appreciated!