I'm not certain what types of "notifications" you get out of Operations Manager so this might not be relevant, and I'm not saying that this is the only way or even the best way to retrieve "events"...but here's an example of how I deal with collecting events from the messages log of my controllers (and no potshots at my cruddy coding skills either! 😞
################################
# Controller Event Capture #
# #
# Find your events in the #
# variable $Controller_Events #
# when completed... #
################################
# Initialize your linked lists...
$Controller_Messages = New-Object Collections.Generic.LinkedList[PSObject]
$Controller_Events = New-Object Collections.Generic.LinkedList[PSObject]
# Number of Days you want to retrieve events from...
$Days = [double]2
# Read in the messages file and create a linked list of lines...
ForEach ($ln in ((Read-NaFile -Controller $YOURCONTROLLER -Path '/vol/vol0/etc/messages').Split("`r`n")))
{
$null = $Controller_Messages.AddLast($ln)
}
# Initialize a counter variable...
$Count = 0
# Loop through each line and create a new linked list of custom objects... (I filter out repeats...but you don't have to...)
ForEach ($Line in ($Controller_Messages | Where {$_ -notlike '*last message*'} | Where {$_.length -gt 0}))
{
$NA_Event = New-Object -TypeName System.Management.Automation.PSObject
If (((($Line.Split('[') | Select -First 1).trim()).substring(0,((($Line.Split('[') | Select -First 1).trim()).Length - 4))) -match ' ')
{
$NA_Event | Add-Member -Name 'TimeStamp' -MemberType NoteProperty -Value ([datetime]::ParseExact((($Line.Split('[') | Select -First 1).trim()).substring(0,((($Line.Split('[') | Select -First 1).trim()).Length - 4)),"ddd MMM d HH:mm:ss", $null))
}
Else
{
$NA_Event | Add-Member -Name 'TimeStamp' -MemberType NoteProperty -Value ([datetime]::ParseExact((($Line.Split('[') | Select -First 1).trim()).substring(0,((($Line.Split('[') | Select -First 1).trim()).Length - 4)),"ddd MMM %d HH:mm:ss", $null))
}
$NA_Event | Add-Member -Name 'TimeZone' -MemberType NoteProperty -Value (($Line.Split('[') | Select -First 1).trim()).substring((($Line.Split('[') | Select -First 1).trim()).length - 3)
$NA_Event | Add-Member -Name 'Source' -MemberType NoteProperty -Value (($Line.Split(':') | Select -Index 2).split('[') | Select -Last 1)
$NA_Event | Add-Member -Name 'MessageIndex' -MemberType NoteProperty -Value $Count
$NA_Event | Add-Member -Name 'EventType' -MemberType NoteProperty -Value ($Line.Split(':') | Select -Index 3).trim()
$NA_Event | Add-Member -Name 'Severity' -MemberType NoteProperty -Value (($Line.Split(':') | Select -Index 4).Split(']')|Select -First 1)
$NA_Event | Add-Member -Name 'Message' -MemberType NoteProperty -Value ([regex]::Split($Line,']:')| Select -Last 1).Trim()
$Count++
# You can modify the following to filter for only the severity that you'd like to collect...
If ((($NA_Event.Severity -like '*error*') -or ($NA_Event.Severity -like '*warning*')) -and ($NA_Event.TimeStamp -ge (Get-Date).AddDays(-$Days)))
{
$null = $Controller_Events.AddLast($NA_Event)
}
}
I too would like to see a commandlet that handled it more efficiently however... Possibly a way to pull out events from the audit log as well...
