{"id":15381,"date":"2011-03-08T00:01:00","date_gmt":"2011-03-08T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2011\/03\/08\/how-to-improve-the-performance-of-a-powershell-event-log-query\/"},"modified":"2011-03-08T00:01:00","modified_gmt":"2011-03-08T00:01:00","slug":"how-to-improve-the-performance-of-a-powershell-event-log-query","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-to-improve-the-performance-of-a-powershell-event-log-query\/","title":{"rendered":"How to Improve the Performance of a PowerShell Event Log Query"},"content":{"rendered":"

Summary<\/b>: Learn how to improve the performance of a Windows PowerShell event log query.<\/p>\n

\"Hey, Hey, Scripting Guy! I am a beginner when it comes to using Windows PowerShell, and I was inspired by your article yesterday about using Windows PowerShell to Query All Event Logs for Recent Events<\/a>, and today I attempted to write a command to get all of the events generated by LANDESK in the application event log. <\/p>\n

Here is the code I put together. <\/p>\n

\n

Get-WinEvent -Logname Application -EA silentlycontinue |<\/span><\/p>\n

where-object { $_.providername.ToLower().contains(“landesk”) -AND $_.timecreated -gt [datetime]::today}<\/span><\/p>\n<\/blockquote>\n

The code appears to work well, but it is very slow and CPU intensive. Am I missing something?<\/p>\n

—MZ<\/p>\n

\"Hey,Hello MZ, <\/p>\n

Microsoft Scripting Guy, Ed Wilson, here. It has been a really long time since I have had anything to do with the LANDESK product; therefore, I do not have it installed on my computer. However, that does not really matter, because what you are talking about is attempting to speed up the results of a query. I have talked about measuring the speed of Windows PowerShell commands<\/a> in the past. In fact, it is one of my favorite topics. <\/p>\n

The first thing I need to do is to obtain a baseline of query performance. As I mentioned earlier, I do not have LANDESK installed on my computer; therefore, I decided to query for events related to WMI. An example of such an event is shown here.<\/p>\n

\"Image<\/a><\/p>\n

The command that I derived is very much like yours—in fact, it is identical, except for the name of the provider. <\/p>\n

\n

Get-WinEvent -LogName application -ea SilentlyContinue | <\/span><\/p>\n

Where-Object { $_.providername.ToLower().Contains(‘wmi’) -AND <\/span><\/p>\n

$_.TimeCreated -gt [datetime]::today }<\/span><\/p>\n<\/blockquote>\n

To measure the performance of the command, I use the Measure-Command<\/b> Windows PowerShell cmdlet. It accepts a parameter called Expression <\/i>which is where the Windows PowerShell command is placed. The command that is shown here is the command to time the Get-WinEvent<\/b> command listed previously.<\/p>\n

\n

Measure-Command -Expression {<\/span><\/p>\n

Get-WinEvent -LogName application -ea SilentlyContinue | <\/span><\/p>\n

Where-Object { $_.providername.ToLower().Contains(‘wmi’) -AND <\/span><\/p>\n

$_.TimeCreated -gt [datetime]::today }<\/span><\/p>\n

}<\/span><\/p>\n<\/blockquote>\n

When I am working with commands that use more than one or two lines in the Windows PowerShell console, I tend to use the Windows PowerShell ISE because it makes it easier to keep track of the commands, and it makes it easier to modify those commands. The command and its associated output are shown in the following image.<\/p>\n

\"Image<\/a><\/p>\n

On my computer, the previous command completes in just a little more than 21 seconds. In reality, that is not too horribly bad. After all, the application log on my computer consumes 20 megabytes of disk space, and it contains 21810 entries. I found the size by looking at the event log properties in the Event Viewer. I determined the number of entries in the log by using the Measure-Object<\/b> cmdlet as shown here.<\/p>\n

\n

PS C:\\> Get-WinEvent -LogName application | Measure-Object<\/span><\/p>\n

Count : 21810<\/span><\/p>\n

Average :<\/span><\/p>\n

Sum :<\/span><\/p>\n

Maximum :<\/span><\/p>\n

Minimum :<\/span><\/p>\n

Property :<\/span><\/p>\n<\/blockquote>\n

MZ, I noticed that you posted a comment on yesterday’s Hey Scripting Guy! blog<\/a> in addition to sending an email message to the scripter@microsoft.com<\/a> alias. Bartek, one of our readers, suggested you were working too hard, and offered a revision to your command. I think it will be fun to test his revision, and see what happens. Here is the command with the modifications suggested by Bartek. <\/p>\n

\n

Measure-Command -Expression {<\/span><\/p>\n

Get-WinEvent -LogName application -ea 0 | <\/span><\/p>\n

Where-Object { $_.providername -match ‘wmi’ -AND <\/span><\/p>\n

$_.TimeCreated -gt [datetime]::today }<\/span><\/p>\n

}<\/span><\/p>\n<\/blockquote>\n

The first change Bartek made was to change –ea SilentlyContinue<\/i> to –ea 0<\/i>. As it turns out, 0 is the enumeration value for SilentlyContinue<\/i>. I found that out by using the Get-EnumAndValues.ps1 script from my Enumerations and Values Weekend Scripter<\/a> article. The other enumerations and values from the “System.Management.Automation.ActionPreference” enumeration are shown here.<\/p>\n

\n

Name Value<\/span><\/p>\n

—- —–<\/span><\/p>\n

Inquire 3<\/span><\/p>\n

Continue 2<\/span><\/p>\n

Stop 1<\/span><\/p>\n

SilentlyContinue 0<\/span><\/p>\n<\/blockquote>\n

The next change he made was to remove tolower <\/i>and contains <\/i>from your query, and replace them with the –match<\/i> operator. The resultant clause is shown here.<\/p>\n

\n

$_.providername -match ‘wmi’<\/span><\/p>\n<\/blockquote>\n

On my computer, when I measured the performance of the revised command, the results were a little more than 21 seconds. This is shown in the following image.<\/p>\n

\"Image<\/a><\/p>\n

Bartek is correct MZ, you are doing too much work. As you can see, there was no advantage to converting to all lowercase and using the contains<\/i> method. <\/p>\n

The first thing I want to do is to quit searching for the provider and replace it with the proper provider name. I use the following command to find the WMI provider name. <\/p>\n

\n

PS C:\\> (get-winevent -listlog Application).providernames | where { $_ -match ‘wmi’}<\/span><\/p>\n

WMI.NET Provider Extension<\/span><\/p>\n

Microsoft-Windows-WMI<\/span><\/p>\n<\/blockquote>\n

When I search for event log providers that match the string ‘wmi’, I found that there are two providers. I assumed that there was only one match, when there were actually two matches. This could skew the accuracy of my queries. I think I really want the Microsoft-Windows-WMI provider, but I check the event log in Event Viewer to be sure. This is illustrated in the following image.<\/p>\n

\"Image<\/a><\/p>\n

Now that I know the provider name, I can use it directly with the Get-WinEvent<\/b> cmdlet. The first thing to remember is that I cannot use the ProviderName<\/i> parameter and the LogName<\/i> parameter in the same command. It seems like a major limitation; but in reality, it is not. This is because an event log provider can only be registered with one event log. The revised command and associated output are shown here.<\/p>\n

\n

PS C:\\Users\\ed.NWTRADERS> Get-WinEvent -ea SilentlyContinue `<\/span><\/p>\n

-ProviderName “Microsoft-Windows-WMI”| <\/span><\/p>\n

Where-Object { $_.TimeCreated -gt [datetime]::today }<\/span><\/p>\n

TimeCreated ProviderName Id Message<\/span><\/p>\n<\/blockquote>\n

\n

———– ———— — ——-<\/span><\/p>\n

3\/7\/2011 6:42:46 AM Microsoft-Windows-WMI 5617 Windows Management In…<\/span><\/p>\n

3\/7\/2011 6:42:46 AM Microsoft-Windows-WMI 5615 Windows Management In…<\/span><\/p>\n<\/blockquote>\n

Just watching the command run, I could see that there was a significant improvement in speed. In fact, the results took less than a second. The modification and the output are shown here.<\/p>\n

\"Image<\/a><\/p>\n

The big reason for the big performance improvement is reducing the number of event log entries that are identified by the Get-WinEvent<\/b> cmdlet prior to shipping the events over the pipeline to be filtered by the Where-Object<\/b> cmdlet. It is always faster to filter before sending to the Where-Object<\/b> than to filter afterwards. <\/p>\n

It is possible to remove the Where-Object<\/b> cmdlet completely. To do this requires using the FilterHashTable <\/i>parameter. The hash table will let you filter on LogName<\/i>, ProviderName<\/i>, Path<\/i>, Keywords<\/i>, Id<\/i>, Level<\/i>, StartTime<\/i>, EndTime,<\/i> and UserId<\/i>. For more information about using FilterHashTable,<\/i> see the Use a PowerShell Cmdlet to Filter Event Log for Easy Parsing<\/a> Hey! Scripting Guy article. <\/p>\n

In using the FilterHashTable<\/i> parameter, I am able to completely remove the Where-Object<\/b> cmdlet. The revised command is shown here.<\/p>\n

\n

Get-WinEvent -ea SilentlyContinue `<\/span><\/p>\n

-FilterHashtable @{ProviderName= “Microsoft-Windows-WMI”; <\/span><\/p>\n

LogName = “application”; StartTime = [datetime]::today}<\/span><\/p>\n

When I run the command, it returns quickly. To see how quickly, I added it to the Measure-Command<\/b> command as shown here.<\/span><\/p>\n

Measure-Command -Expression {<\/span><\/p>\n

Get-WinEvent -ea SilentlyContinue `<\/span><\/p>\n

-FilterHashtable @{ProviderName= “Microsoft-Windows-WMI”; <\/span><\/p>\n

LogName = “application”; StartTime = [datetime]::today}<\/span><\/p>\n

}<\/span><\/p>\n<\/blockquote>\n

On my system, this command results in only a slight improvement over the previous command. This is shown in the following image.<\/p>\n

\"Image<\/a><\/p>\n

MZ, that is all there is to using Get-WinEvent<\/b> parameters and the Measure-Command<\/b> cmdlet to improve query performance. I invite you to join me tomorrow for more Windows PowerShell goodness. <\/p>\n

I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

Ed Wilson, Microsoft Scripting Guy<\/b><\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Learn how to improve the performance of a Windows PowerShell event log query. Hey, Scripting Guy! I am a beginner when it comes to using Windows PowerShell, and I was inspired by your article yesterday about using Windows PowerShell to Query All Event Logs for Recent Events, and today I attempted to write a […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[97,51,98,60,3,4,45],"class_list":["post-15381","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-event-logs","tag-getting-started","tag-logs-and-monitoring","tag-performance","tag-scripting-guy","tag-scripting-techniques","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Summary: Learn how to improve the performance of a Windows PowerShell event log query. Hey, Scripting Guy! I am a beginner when it comes to using Windows PowerShell, and I was inspired by your article yesterday about using Windows PowerShell to Query All Event Logs for Recent Events, and today I attempted to write a […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/15381","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=15381"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/15381\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=15381"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=15381"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=15381"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}