0
\$\begingroup\$

I'm using a script to monitor a file. When a pattern is detected, it will send an email to notify someone.

I am creating a Windows Service via NSSM.

My question is : How can I improve performance of my script ? I have to monitor a large log file during the day. a rolling log file (log1.log, then log2.log, then log3.log etc) main log file is log.log. The time between log file rotations in seconds. Rotation time is about 2-3 seconds. Log file size is about 20-30MB.

Script :

while( $true ) {

Start-Transcript -path c:\temp\monitor_file.log

$fromaddress = "[email protected]"
$emailto = "[email protected]"
$SMTPSERVER = "xx.xx.xx.xx"

$File = "C:\temp\log.log"
Get-Content $File -Wait -Last 0 | Select-string  'Finished.' | ForEach {
    Send-mailmessage -from $fromaddress -to $emailto -subject "Log changed" -smtpServer $SMTPSERVER -Encoding UTF8 -Priority High
}

}
\$\endgroup\$
1
  • \$\begingroup\$ How time-sensitive is this ? If you can afford to wait until the log rotates to send your email you could watch for file creation (as in this question: stackoverflow.com/questions/29066742/… ) and read the second log (log1.log) ? \$\endgroup\$
    – anto418
    Mar 27, 2023 at 9:33

1 Answer 1

1
\$\begingroup\$

First of all, Get-Content on a 20-30MB file every 2-3 seconds is very resource intensive, and wasteful if the file only changes a few times a minute. I would follow @anto418's advice, and use a FilesystemWatcher.

There are also optimizations you can do within the FilesystemWatcher's event handler to prevent it reading unnecessary data. You don't want to start from the beginning if you've already read the file several times.

  • One option is to set a pointer to the last position you read, and start reading from there whenever there is a change. Filestream.Read allows you to start at an offset within the file.
  • If the 'Finished.' line is always one of the last few lines written, you can optimize further by using the -Tail parameter to Get-Content: Get-Content $File -Tail 2 This may have been your intent with the -last 0 parameter, but -last doesn't seem to be supported.

I've heard the -Wait parameter can lock a file so you miss changes or interfere with writing to it. It's worth testing that this actually works, or removing that parameter.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.