used to parse RADIUS log files

Parse-RADIUSLogs.ps1

$files= Get-childitem Y: | select -last 90

function Process-RADIUSLogs () {
[CmdletBinding()]
param(
$file,
[switch]$onlyAccepted
)
            
    if ($onlyAccepted) {Write-Verbose "Processing only authenticated attempts"}
    Write-Verbose "Processing $file"
    $data = get-Content $file
    for ($i=0; $i -lt $data.count; $i++) {
        if($onlyAccepted) {
            $data[$i] -match '".+?",".+?",(?<date>.+?),2,,"(?<distinguishedname>.+?)"' | out-null
            if ($matches) {
                New-object -TypeName PSObject -Property @{
                    Date = $matches['date']
                    DistinguishedName = $matches['distinguishedname']
                }
                $matches = $Null
            }
        } else {
            $data[$i] -match '"(?<server>.+?)","(?<process>.+?)",(?<date>.+?),(?<status>1|2|3),"(?<username>.+?)","(?<distinguishedname>.+?)","(?<publicIP>.+?)","(?<srcIP>.+?)",' | out-null
            if ($matches) {
                New-object -TypeName PSObject -Property @{
                    Date = $matches['date']
                    Status = $matches['status']
                    Username = $matches['username']
                    DistinguishedName = $matches['distinguishedname']
                    SourceIP = $matches['srcIP']
                }
                $matches = $Null
            }
        }
        
    }
}


$results = $files |Foreach {Process-RADIUSLogs -file $_.fullname -verbose -onlyAccepted}

$results | export-csv C:\temp\RADIUSLOGS.csv -NoTypeInformation


Process-RADIUSLogs -file Y:\IN210411.log -onlyAccepted