How to tail log files from particular string

Question

Hello,
We would like to tail several log files "live" in powershell for particular string. We have tried to use "get-content" command but without luck because everytime as a result we received only results from one file. I assume that it was
caused by "-wait" parameter. If there is any other way to tail multiple files ?
Our sample script below
dir d:\test\*.txt -include *.txt | Get-Content -Wait | select-string "windows" |ForEach-Object {Write-EventLog -LogName Application -Source "Application error" -EntryType information -EventId 999 -Message $_}
Any help will be appreciated.
Mac

Answer 1

Because we want to capture particular string from that files. Application writes some string time to time and when the string appears we want to catch it and send an eventy to application log, after it our Nagios system will raise alarm.
Mac
Alright, this is my answer, but I think you won't like it.
Run this PowerShell code in PowerShell ISE:
$file1='C:\Temp\TFile1.txt'
'' > $file1
$file2='C:\Temp\TFile2.txt'
'' > $file2
$special='windowswodniw'
$exit='exit'
$sb1={
gc $using:file1 -Wait | %{
if($_-eq$using:exit){
exit
}else{
sls $using:special -InputObject $_ -SimpleMatch
} | %{
Write-Host '(1) found special string: ' $_
$sb2={
gc $using:file2 -Wait | %{
if($_-eq$using:exit){
exit
}else{
sls $using:special -InputObject $_ -SimpleMatch
} | %{
Write-Host '(2) found special string: ' $_
sajb $sb1
sajb $sb2
In this code, $file1 and 2 are the files being waited for.
As I understood you, you care only for the special string, which is in the variable $special.
All other variables, will be discarded.
Also, whenever a string equals to $exit is written to the file, the start job corresponding to that file will be terminated, automatically! (simple, right?)
In the example above, I use only 2 files (being watched) but you can extend it, easily, to any number (as long as you understand the code).
If you are following my instructions, at this point you have PowerShell ISE  running, with 2 background jobs,
waiting for data being inputed to $file1 and 2.
Now, it's time to send data to $file1 and 2.
Start PowerShell Console to send data to those files.
From its command line, execute these commands:
$file1 = 'C:\Temp\TFile1.txt'
$file2='C:\Temp\TFile2.txt'
$exit='exit'
Notice that $file1 and 2 are exactly the same as those defined in P
OWERSHELL ISE, and that I've defined the string that will terminate the background jobs.
Command these commands in PowerShell Console:
'more' >> $file1
'less' >> $file1
'more' >> $file2
'less' >> $file2
These commands will provoke no consequences, because these strings will be discarded (they do not contain the special string).
Now, command these commands in PowerShell Console:
'windowswodniw' >> $file1
'1 windowswodniw 2' >> $file1
'more windowswodniw less' >> $file1
'windowswodniw' >> $file2
'1 windowswodniw 2' >> $file2
'more windowswodniw less' >> $file2
All these will be caugth by the (my) code, because they contain the special
string.
Now, let's finish the background jobs with these commands:
$exit >> $file1
$exit >> $file2
The test I'm explaining, now is DONE, TERMINATED, FINISHED, COMPLETED, ...
Time to get back to PowerShell ISE.
You'll notice that it printed out this (right at the beginning):
Id Name PSJobTypeName State HasMoreData Location Command
1 Job1 BackgroundJob Running True localhost ...
2 Job2 BackgroundJob Running True localhost ...
At PowerShell ISE's console, type this:
          gjb
And you'll see the ouput like:
Id Name PSJobTypeName State HasMoreData Location Command
1 Job1 BackgroundJob Completed True localhost ...
2 Job2 BackgroundJob Completed True localhost ...
          (  They are completed!  )
Which means the background jobs are completed.
See the background jobs' outputs, commanding this:
          gjb | rcjb
The output, will be something like this:
(1) found special string: windowswodniw
(1) found special string: 1 windowswodniw 2
(1) found special string: more windowswodniw less
(2) found special string: windowswodniw
(2) found special string: 1 windowswodniw 2
(2) found special string: more windowswodniw less
I hope you are able to understand all this (the rubbishell coders, surely, are not).
In my examples, the strings caught are written to host's console, but you can change it to do anything you want.
P.S.: I'm using PowerShell, but I'm pretty sure you can use older PowerShell ( version 3 ). Anything less, is not PowerShell anymore. We can call it RubbiShell.