Learn about Windows PowerShell
Summary: The Scripting Wife details her experience creating a script for Beginner Event 7 in the 2012 Scripting Games.
I will tell you what...sometimes I wonder about that Script Monkey. Actually, it is more than just sometimes. I thought this event was just a wee bit too hard. My score will probably drop several notches. Right now I am in position 21 (not that it matters, because I am ineligible for anything), but it is kind of cool. What is more cool is that only 1.5 points separate #1 from #28. I know, however, after my entry for this event factors in, I will no longer be in position 21. Oh well.
So what was my problem? I could not figure out how to get hidden event logs. Getting enabled event logs that have more than 0 records is not too hard. I needed to create a compound Where clause and look for records that are enabled and that have more than 0 records. This type of Where clause is a little tricky, but I used it in an earlier event when we were looking for running services that could also stop. If you missed that, you may want to look at some other people's entries (who got good scores). You may also want to look at some of the judges blogs (I talked about them in 2012 Scripting Games Blog Roll) because I remember seeing a blog by Don Jones where he talked about doing a compound Where clause. He gave a great example.
After sorting it, I picked up the two properties I needed and formatted it as a table. By the way, you might want to look at the Weekend Scripter: Troubleshooting Windows Hey, Scripting Guy! blog. It gave me several things to think about as I worked on my solution.
I guess maybe it was not really too hard, I will see when I get my score.
I hope you are doing well in the 2012 Scripting Games. Oh, by the way, if you are going to be in Atlanta on Saturday April 14, 2012, the Scripting Guy and I will be at the SQL Saturday #111 at the Georgia State University in Alpharetta. Hope to see you there.
Same issue here with the hidden event logs... I have an idea, but not sure if I'm over-thinking the problem or if it's simple.
Same issue here... Been struggling to get the hidden event logs.... Still wondering if it is too hard or too simple i cannot see it!
@Dawn Villejoin @Eletheria it is not too difficult --- once you find the solution.
I've just started looking at this one and after spending a while playing with the cmdlet I thought would do this gave up and decided to check @scriptingguyswife advice. After seeing she's having the same problem I realised that my assumed 'cmdlet' just wasn't going to cut it. Fired off a Get-Command with specific criteria and got a hint at another cmdlet. Ran the help files and all became clear! You'll kick yourself no doubt!
Makes me think of @IamMred's advice; "Don't assume anything".
I found the -Online help to be useful in this, but I had to go to another link mentioned in the help to fully meet the requirements. Interestingly after I figured out the hidden logs, I found a ScriptingGuy blog from last year about clearing logs that helped me confirm that that part of my solution is correct.
Hi Scripting Wife,
Microsoft-Windows-WMI-Activity/Trace leaves the recordcount field empty even if it has records and is enabled.
Many of the users scripts are not picking up this log correctly because they are checking the .recordcount field to be greater than zero.
Thank you for all your help.