Troubleshooting with PowerShell: Event Logs, Performance Counters, and More

by | PowerShell Basics

PowerShell Basics - Troubleshooting - Event Logs, Performance Counters and More by Michael Simmons

PowerShell is an invaluable tool for System Administrators when it comes to troubleshooting system issues. With its wide range of built-in cmdlets and flexibility, PowerShell enables you to investigate issues, monitor performance, and manage services and processes. In this article, we will explore how to use PowerShell for troubleshooting, covering event logs, performance counters, services, and processes.

Working with Event Logs

Viewing Event Logs with PowerShell

To view event logs with PowerShell, you can use the Get-WinEvent cmdlet. This cmdlet retrieves events from event logs, including classic logs and the newer event tracing logs. To get events from the System log, for example:

Get-WinEvent -LogName System

Filtering and Searching

Get-WinEvent provides a powerful filtering mechanism using the -FilterHashtable parameter. For example, to retrieve only Error events from the Application log:

Get-WinEvent -FilterHashtable @{ LogName='Application'; Level=2 }

Creating Custom Event Logs

You can create custom event logs to record application-specific events. To create a new event log, use the New-EventLog cmdlet:

New-EventLog -LogName "CustomLog" -Source "MyApp"

Monitoring Performance Counters

Accessing Performance Counters

PowerShell provides the Get-Counter cmdlet to access performance counters. For example, to retrieve the current processor time percentage:

Get-Counter -Counter "\Processor(_Total)\% Processor Time"

Real-time Monitoring

You can monitor performance counters in real-time by using the -Continuous parameter and specifying an update interval with the -SampleInterval parameter:

Get-Counter -Counter "\Processor(_Total)\% Processor Time" -Continuous -SampleInterval 5

Analyzing Performance Data

Export performance counter data to a CSV file for further analysis:

$counterData = Get-Counter -Counter "\Processor(_Total)\% Processor Time" -MaxSamples 10
$counterData | Export-Counter -Path "performance_data.csv" -FileFormat CSV

Using PowerShell to Manage Services

Listing Services

Use the Get-Service cmdlet to list all services on a system:

Get-Service

Starting, Stopping, and Restarting Services

To start, stop, or restart a service, use the Start-Service, Stop-Service, and Restart-Service cmdlets, respectively:

Start-Service -Name "MyService"
Stop-Service -Name "MyService"
Restart-Service -Name "MyService"

Monitoring Service Status

Monitor a service status by filtering the output of Get-Service:

Get-Service -Name "MyService" | Select-Object -Property Status, Name, DisplayName

Troubleshooting Processes

Listing Processes

Use the Get-Process cmdlet to list all running processes on a system:

Get-Process

Filtering and Sorting Processes

You can filter and sort the process list based on specific criteria, such as memory usage or CPU time:

Get-Process | Where-Object { $_.WorkingSet64 -gt 100MB } | Sort-Object -Property CPU -Descending

Terminating Processes

To terminate a process, use the Stop-Process cmdlet:

Stop-Process -Name "Notepad" -Force

Tips for Effective Troubleshooting

  • Combine PowerShell cmdlets and utilize pipelines to create efficient troubleshooting scripts.
  • Use the -FilterScript parameter with Where-Object to filter data based on complex criteria.
  • Export data to CSV or JSON formats for further analysis using the Export-Csv and ConvertTo-Json cmdlets.
  • Familiarize yourself with common performance counters, event log types, and service names for faster troubleshooting.
  • Always test your scripts in a safe environment before running them on production systems.

Conclusion

PowerShell is a versatile and powerful tool for troubleshooting system issues. By understanding how to work with event logs, performance counters, services, and processes, you will become more effective in diagnosing and resolving problems on your systems. As always, practice and continued learning are essential to mastering PowerShell. Consider enrolling in a PowerShell course or finding a mentor to help you further develop your troubleshooting skills. As you gain proficiency, you’ll find that PowerShell is an indispensable tool in your System Administrator toolkit.