Powershell script real-time monitoring via Windows Service

Question

I'm using a script to monitor a file. When a pattern is detected, it will send an email to notify someone.

I am creating a Windows Service via NSSM.

My question is : How can I improve performance of my script ? I have to monitor a large log file during the day. a rolling log file (log1.log, then log2.log, then log3.log etc) main log file is log.log. The time between log file rotations in seconds. Rotation time is about 2-3 seconds. Log file size is about 20-30MB.

Script :

while( $true ) {

Start-Transcript -path c:\temp\monitor_file.log

$fromaddress = "[email protected]"
$emailto = "[email protected]"
$SMTPSERVER = "xx.xx.xx.xx"

$File = "C:\temp\log.log"
Get-Content $File -Wait -Last 0 | Select-string  'Finished.' | ForEach {
    Send-mailmessage -from $fromaddress -to $emailto -subject "Log changed" -smtpServer $SMTPSERVER -Encoding UTF8 -Priority High
}

}

Answer 1

First of all, Get-Content on a 20-30MB file every 2-3 seconds is very resource intensive, and wasteful if the file only changes a few times a minute. I would follow @anto418's advice, and use a FilesystemWatcher.

There are also optimizations you can do within the FilesystemWatcher's event handler to prevent it reading unnecessary data. You don't want to start from the beginning if you've already read the file several times.

• One option is to set a pointer to the last position you read, and start reading from there whenever there is a change. Filestream.Read allows you to start at an offset within the file.
• If the 'Finished.' line is always one of the last few lines written, you can optimize further by using the -Tail parameter to Get-Content: Get-Content $File -Tail 2 This may have been your intent with the -last 0 parameter, but -last doesn't seem to be supported.

I've heard the -Wait parameter can lock a file so you miss changes or interfere with writing to it. It's worth testing that this actually works, or removing that parameter.