Skip to content

Instantly share code, notes, and snippets.

@p0w3rsh3ll
Last active January 9, 2018 10:44
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save p0w3rsh3ll/fbe68df93dd9a15365d5e25151f6cc67 to your computer and use it in GitHub Desktop.
Save p0w3rsh3ll/fbe68df93dd9a15365d5e25151f6cc67 to your computer and use it in GitHub Desktop.
Function Import-WindowsUpdateLog {
<#
.SYNOPSIS
Read the content of the Windows Update log and import it as an object
.DESCRIPTION
Read the content of the Windows Update log and import it as an object.
It will read each line and create an object with the following properties:
Date,Hour,PID,TID,Component,Message
.PARAMETER FilePath
The path of the windows update log file.
.EXAMPLE
Import-WindowsUpdateLog -FilePath ~\Desktop\WindowsUpdate.log
.EXAMPLE
"~\Desktop\WindowsUpdate.log" | Import-WindowsUpdateLog | Out-GridView
.EXAMPLE
Get-Item ~\Desktop\WindowsUpdate.log | Import-WindowsUpdateLog | Out-GridView
#>
[CmdletBinding()]
Param(
[Parameter(Mandatory,ValueFromPipeline,ValueFromPipelineByPropertyName)]
[Alias('Path','PSPath')]
[ValidateScript({
Test-Path -Path $_ -PathType Leaf
})]
[string]$FilePath
)
Begin {}
Process {
try {
Get-Content -Path $FilePath -ReadCount 1 -ErrorAction Stop |
ForEach-Object {
$Date,$Hour,$WUPID,$WUTID,$Component,$Message = (
[regex]'^(?<Date>2\d{3}/\d{2}/\d{2})\s+(?<Hour>\d{2}:\d{2}:\d{2}\.\d{1,23})\s+(?<PID>\d{1,6})\s+(?<TID>\d{1,6})\s+(?<Component>[a-zA-Z]+)\s+(?<Message>.+)'
).Match($_).Groups | Select-Object -Last 6 -ExpandProperty Value
[PsCustomObject]@{
Date = $Date
Hour = $Hour
PID = $WUPID
TID = $WUTID
Component = $Component
Message = $Message
}
}
} catch {
Throw "Failed because $($_.Exception.Message)"
}
}
End {}
}
@0xfeeddeadbeef
Copy link

Nitpick: Moving [regex] initialization to begin {} block will speed it up a little bit: 567 ms vs. 121 ms on my machine (WindowsUpdate.log with ~11000 lines).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment