只解析文本文件的最後一部分

Question

我有一個通過PowerShell進行SQL Server數據庫備份的進程，它在遍歷數據庫時記錄到單個文本文件。當我們遇到錯誤時，我想將它們記錄到表中，但是本機T-SQL可以防止在Try-Catch塊中獲得備份錯誤消息，所以我想從文本文件中獲取這些信息。

我想只抓取來自最新數據庫的消息。因此我的問題。

考慮下面的文本樣本：

12:31:32.310 ############# 
12:31:32.326 # Database1 # 
12:31:32.326 ############# 

DBCC execution completed. If DBCC printed error messages, contact your system administrator. 
Msg 5901, Level 16, State 1, Server Server1, Line 1 
One or more recovery units belonging to database 'Database1' failed to generate a checkpoint. This is typically caused by lack of system resources such as disk or memory, or in some cases due to database corruption. Examine previous entries in the error log for more detailed information on this failure. 
Msg 9002, Level 17, State 4, Server Server1, Line 1 
The transaction log for database 'Database1' is full due to 'ACTIVE_TRANSACTION'. 
Msg 3013, Level 16, State 1, Server Server1, Line 1 
BACKUP DATABASE is terminating abnormally. 
Msg 3201, Level 16, State 2, Server Server1, Line 4 
Cannot open backup device 'D:\Backups\Database1\Database1_201408260031_backup_Native_DIFF.bak'. Operating system error 2(The system cannot find the file specified.). 
Msg 3013, Level 16, State 1, Server Server1, Line 4 
VERIFY DATABASE is terminating abnormally. 

12:31:31.435 ############# 
12:31:31.435 # Database2 # 
12:31:31.435 ############# 

DBCC execution completed. If DBCC printed error messages, contact your system administrator. 
BACKUP DATABASE [Database2] TO DISK = N'D:\Backups\Database2\Database2_backup_Native_FULL.bak' WITH STATS=10,INIT,COMPRESSION; 
43 percent processed. 
86 percent processed. 
99 percent processed. 
Processed 296 pages for database 'Database2', file 'Database2' on file 1. 
100 percent processed. 
Processed 2 pages for database 'Database2', file 'Database2_log' on file 1. 
BACKUP DATABASE successfully processed 298 pages in 0.180 seconds (12.893 MB/sec). 
The backup set on file 1 is valid. 

12:31:32.310 ############# 
12:31:32.326 # Database3 # 
12:31:32.326 ############# 

DBCC execution completed. If DBCC printed error messages, contact your system administrator. 
Msg 5901, Level 16, State 1, Server Server1, Line 1 
One or more recovery units belonging to database 'Database3' failed to generate a checkpoint. This is typically caused by lack of system resources such as disk or memory, or in some cases due to database corruption. Examine previous entries in the error log for more detailed information on this failure. 
Msg 9002, Level 17, State 4, Server Server1, Line 1 
The transaction log for database 'Database3' is full due to 'ACTIVE_TRANSACTION'. 
Msg 3013, Level 16, State 1, Server Server1, Line 1 
BACKUP DATABASE is terminating abnormally. 
Msg 3201, Level 16, State 2, Server Server1, Line 4 
Cannot open backup device 'D:\Backups\Database3\Database3_201408260031_backup_Native_DIFF.bak'. Operating system error 2(The system cannot find the file specified.). 
Msg 3013, Level 16, State 1, Server Server1, Line 4 
VERIFY DATABASE is terminating abnormally. 

我只希望下面的輸出只是數據庫3：

One or more recovery units belonging to database 'Database3' failed to generate a checkpoint. This is typically caused by lack of system resources such as disk or memory, or in some cases due to database corruption. Examine previous entries in the error log for more detailed information on this failure. 
The transaction log for database 'Database3' is full due to 'ACTIVE_TRANSACTION'. 
BACKUP DATABASE is terminating abnormally. 
Cannot open backup device 'D:\Backups\Database3\Database3_201408260031_backup_Native_DIFF.bak'. Operating system error 2(The system cannot find the file specified.). 
VERIFY DATABASE is terminating abnormally. 

我走了這麼遠，但需要上述篩選出任何錯誤數據庫3。

Get-Content ("C:\SampleError.txt") | Select-String -SimpleMatch "Msg" -Context 0, 1 | %{ ($_.Context.PostContext); } 

我基本上需要過濾只有最後的塊（＃數據庫3＃）上獲取內容，但我無法找到這樣做的正確方法（LastIndexOf？）。我想避免出於可支持性的原因而使用正則表達式，但願意接受建議。謝謝你的幫助！

Answer 1

好的，讓我們來做這個。找到最後一行12:34:56.789 #############，然後Get-Content file.txt |選擇-skip，然後多行，減3。我也抓住時間和數據庫的名稱，並創建一個自定義對象的數組看起來乾淨。顯然，如果你不想做，你可以跳過第2行，併線給ForEach 3

$LinesToSkip = select-string -Path C:\temp\input.txt -Pattern "(\d{2}:\d{2}:\d{2}\.\d{3}\s+?\#+)"|select -last 1 -ExpandProperty linenumber 
$Failure = GC C:\temp\input.txt | Where{$_ -Match "(\d{2}:\d{2}:\d{2}\.\d{3})\s+?\#\s+?([^#]+)\s"}|Select -Last 1 |ForEach{$Matches} 
$Log = Get-Content C:\temp\input.txt | Select -skip ($LinesToSkip - 3) | Select-String -SimpleMatch "Msg" -Context 0, 1 | Select -ExpandProperty Context | Select -ExpandProperty PostContext | ForEach{[PSCustomObject][Ordered]@{'Database'=$Failure[2];'Failure Time'=$Failure[1];'Message'=$_}} 
$Log|FT -AutoSize 
$Log|Export-Csv c:\output.csv -NoTypeInformation 

輸出將去一個CSV文件，並在屏幕上看起來像：

Database Failure Time Message                  
-------- ------------ -------                  
Database3 12:31:32.326 One or more recovery units belonging to database 'Database3' failed to gen... 
Database3 12:31:32.326 The transaction log for database 'Database3' is full due to 'ACTIVE_TRANSA... 
Database3 12:31:32.326 BACKUP DATABASE is terminating abnormally.         
Database3 12:31:32.326 Cannot open backup device 'D:\Backups\Database3\Database3_201408260031_bac... 
Database3 12:31:32.326 VERIFY DATABASE is terminating abnormally. 

Answer 2

你不能使用RegEx過濾「Database3」中的那些嗎？這就是我通常所做的。

下面是一個腳本的鏈接，它完全符合您的要求 - 「...如果您在腳本中使用了-ShowMatchedLines開關，則不會顯示摘要，但是日誌中的每一行匹配至少一個模式將被輸出......「：http://cyber-defense.sans.org/blog/2009/06/23/powershell-script-to-search-logs-with-regular-expressions

Direct link for script zip file。