Get IIS Logs

gistfile1.ps1

function Get-IISLogs {
<#
	.SYNOPSIS
		Gets the IIS Logs for the number of hours specified and returns them as an array of PSObjects.
		
	.DESCRIPTION
		Gets the IIS Logs for the number of hours specified and returns them as an array of PSObjects.
		
	.PARAMETER Hours
		A description of the parameter.
        
    .PARAMETER Hours
        Number of hours to get the logs for. The default is 24.
    
    .PARAMETER Filter
        A scriptblock for a where statement that filters the results of the logs returned.
    
    .PARAMETER Path
        Path to the IIS Logs. Allows for overiding the default location.
	
	.OUTPUTS
		[PSObject[]]
		
	.EXAMPLE
		Get-IISLogs -Hours 2 -Filter { $_.cs_uri_stem -like "*.idx" }
		
	.NOTES
    Author   : Russell Slater
		Date     : 2012-09-06
#>
    [CmdletBinding()]
    param(
        [Parameter(ValueFromPipelineByPropertyName = $true)]
        [int]$Hours = 24,
        [Parameter(ValueFromPipelineByPropertyName = $true)]
        [scriptblock]$Filter,
        [Parameter(ValueFromPipelineByPropertyName = $true)]
        [string]$Path = 'C:\inetpub\logs\LogFiles\W3SVC1'
    )
    
    [int]$date = (Get-Date).AddHours(-$($Hours)).ToString("yyMMddHH")
    
    Write-Verbose "Date: $date"
    
    $firstLogFile = $true

    $list = New-Object System.Collections.Generic.List[PSObject]

    $iisLogs = @()
    
    if( $((Get-Item -Path $Path).GetType().Name) -eq 'DirectoryInfo' ) {
        
        $logFiles = Get-ChildItem -Path $Path | Sort-Object -Property Name -Descending
    }
    else {
        
        $logFiles = @()

        $logFiles += Get-ChildItem -Path $Path
    }

    foreach( $logFile in $logFiles) {

        <#
        #[int]$logDate = $logFile.name.Remove(0, 4).Split('.')[0]
        
        Write-Verbose "Log Date: $logDate"
        
        #if( $logDate -gt $date ) {
        
            Write-Verbose "$logDate is greater than $date."
            #>

            $fileStream = New-Object System.IO.FileStream $logFile.FullName, "Open", "Read", "Read"
            $reader = New-Object System.IO.StreamReader($fileStream)
            
            for( $i = 0; $i -lt 5; $i++ ) {
                
                $line = $reader.ReadLine()

                if( $line -like "#Fields:*" ) {

                    #replace '-' with '_' to allow field names to work as properties in Powershell.

                    $headers = $line.split(" ") | 
                        where {$_ -ne "#Fields:"} |
                        foreach { $_.Replace('-', '_') }
                }
            }

            if( $headers ) {
            
                $rows = Import-Csv -Delimiter " " -Header $headers -Path $logFile.FullName

                foreach( $row in $rows ) {
                
                    if( $row.date -notlike "#*" ) {
                        
                        $list.Add($row)
                    }
                }           
                
                $iisLogs = $list.ToArray()
            }
            else {

                Write-Warning "Headers not found. Log: $logFile not processed."
            }
    }
    
    if( $Filter ) {
        
        $iisLogs = $iisLogs | where $Filter
    }
    
    $iisLogs
}