Monitor HTTP.SYS error log & Alert if string is found
Monitors (if scheduled) the current HTTP.sys error log for a specified string pattern.
Has to be scheduled, every 5 minutes for example. (“-Repeat” option)
http://www.zerrouki.com/schedule-a-powershell-script-execution/
<#
.SYNOPSIS
mon_httperr - Monitor the current HTTP.sys error log for a specified string pattern.
.NOTES
File Name : mon_httperr.ps1
Author : Fabrice ZERROUKI - fabricezerrouki@hotmail.com
.EXAMPLE
PS D:\>.\mon_httperr.ps1
#>
# Definition of the log file to search in
$LastLog = Get-ChildItem C:\WINDOWS\system32\LogFiles\HTTPERR | Sort -Property LastWriteTime | Select -Last 1
# Definition of the searched pattern
$Pattern = @("Connection_Dropped", "Connection_Abandoned_By_AppPool")
# Find the searched string
$Finder = Select-String -Path $LastLog -Pattern $Pattern -SimpleMatch
$Find = $Finder | Select LineNumber, Line | Format-List | Out-File mon_httperr.log
# Count the searched string results
$StrMatches = $Finder.count
if ($StrMatches -eq $null) { $StrMatches = "0" }
# Get the previous run searched string results
if (!(Test-Path matches.log)) { New-Item matches.log -Type file -Value "0" }
$MatchArc = Get-Content matches.log
if ($MatchArc -eq $null) { $MatchArc = "0" }
# Count the difference between this run and the last one
$Diff = $StrMatches - $MatchArc
# Update the searched string results
$StrMatches | Out-File matches.log
if ($Diff -eq 1) { $Message = "1 nouvelle ligne contenant la chaine de caractères `"Connection_Dropped`" ou `"Connection_Abandoned_By_AppPool`" a été trouvée dans le fichier C:\WINDOWS\system32\LogFiles\HTTPERR\" + "$LastLog" }
if ($Diff -gt 1) { $Message = "$Diff nouvelles lignes contenant la chaine de caractères `"Connection_Dropped`" ou `"Connection_Abandoned_By_AppPool`" ont été trouvées dans le fichier C:\WINDOWS\system32\LogFiles\HTTPERR\" + "$LastLog" }
# Send an alert by mail if new searched string results found
if ($Diff -ge 1)
{
$SmtpSrv = "ToBeDefined"
$Me = "ToBeDefined"
$MailTo = "ToBeDefined"
$MailFrom = "ToBeDefined"
$MailSubject = "$env:computername - IIS Monitoring - `"Connection_Dropped / Connection_Abandoned_By_AppPool`" Detected"
$MailBody = @"
<html><span style='font-family: Tahoma; font-size: 12px;' >Bonjour,<br />
<br />
$Message<br />
<br />
----------------------------------------------------------------------------</span><br />
<span style='font-family: Tahoma; font-size: 10px;' >Ce mail est généré automatiquement, merci de ne pas y répondre.<br /> <br /></span></html>
"@
Send-MailMessage -To $MailTo -Subject $MailSubject `
-From $MailFrom -SmtpServer $SmtpSrv -Priority High `
-Bcc $Me -Attachments mon_httperr.log -BodyAsHtml $MailBody
Write-Host "Alert sent by mail to $MailTo"
}