Query a log for error in the last 30 minutes

Question

Hi,
I'm trying to parse a plain text log file for errors and then send an email.
The error code I'm looking for is "297 WARN". I only want to check the last 30 minutes of the log file and will run the PowerShell parsing script every 30 mins.
I'm stuck at the bit where I make PowerShell only scan back the last 30 minutes. When I run the script below without the substring it works but parses the whole log file. How can I get it to stop parsing at the 30 minute timeline??
The script I have so far is as follows:
# Set Time Variable
$Date = Get-Date
$dateStr = $Date.AddMinutes(-30).ToString("yyyy-MM-dd HH:mm")
#Set log file location
$File = "C:\log.txt"
# Get content from log to time
$logfile = Get-Content $File | ? { $_.substring(0,11) -ge $datestr }  | Select-String "297 WARN"
if ($logfile) {
  foreach ($line in $logfile){
    Write-Host $line
<# 
  ###Send Email
    $mailMessage = New-Object System.Net.Mail.MailMessage
    $mailMessage.IsBodyHTML = $true
    $mailMessage.From = "$email"
    $mailMessage.Subject = "Log Checked with Error"
    $SMTPServer = "smtp.mailserver.com"
    $SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 25)
    $mailMessage.To.Add("[email protected]")
    $mailMessage.Body = $line
    $SMTPClient.Send($mailMessage)
    $LogAttachment.Dispose()
#>
  } else {
   Write-Host "$($Date): no errors"
The log file has the following format (two lines shown):
2015-01-21 16:58:43,148 INFO  [ActivityInstanceBean] (CarnotApplicationQueueListenerContainer-1) State change for Activity instance 'Warten',  oid: 1853 (process instance = 259) (model oid = 2, version = 4.1.6, revision = 0): Created-->Hibernated.
2015-01-21 16:59:00,297 WARN  [SQL] (CarnotDaemonQueueListenerContainer-4) Failed query: SELECT oid, type, code, stamp, state, partition FROM dbo.daemon_log WHERE (dbo.daemon_log.type = 'event.daemon' AND dbo.daemon_log.code = 0 AND dbo.daemon_log.partition
= 1)
Thanks very much fro any help!

Answer 1

Hi Dforager,
To parse the log file basd on the datatime, please refer to the script below to start:
$file = "e:\log.txt"
$Date = Get-Date
Get-Content $file |
Select-String "297 WARN" -SimpleMatch |
select -expand line |
foreach {
if($_ -match '(.+),297 WARN\s(.+)'){
new-object psobject -Property @{
Date = [datetime]$matches[1]
Error = $matches[2]}|
where {$_.Date -gt $Date.AddMinutes(-30)}
If there is anything else regarding this script, please feel free to post back.
Best Regards,
Anna Wang
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]