$hell Your Experience !!! #PowerShellLifeStyle

Notification of low disk space (Mount points too) and Handle Alert Suppression–PowerShell

Laerte Junior — Mon, 05 Dec 2011 23:09:58 +0000

We have a server of approval, yes I know it’s approval, but because of holidays and how we are a major retailer, this server has become critical to the business, given that many changes are made to the systems at this time.

As our monitoring process is a bit bureaucratic to happen, we needed a quick solution for verification of low disk space on this server. Solution. Powershell and WMI

I wanted to build a more flexible solution possible, so I thought of a way to the script get all the server volumes and report on a value below X (passed parameter). My first version was:

$Hostname = 'Server01'
$Space = 2048
$SpaceGB =  $Space / 1024
Get-WmiObject               -computername $Hostname  `
                             -query " select Name  from Win32_Volume where  DriveType = 3 and SystemVolume = false and FileSystem = 'NTFS'"              | foreach {
  
               try {
  
                               $Volume = ($($_.name).TrimEnd("\")).replace("\" ,"\\")
                               $SourceIdentifier = (($($_.name)).replace("\" ,"")).replace(":","")
                               $query = "Select * from __instanceModificationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfDisk_LogicalDisk' and targetinstance.Name=`'$($Volume)`' AND TargetInstance.freemegabytes < $space"
                               Register-WMIEvent       -ComputerName $Hostname `
                                                       -Query  $Query  `
                                                         -SourceIdentifier "LowDiskSpace$($SourceIdentifier)" `
                                                         -Action    {
                                                                        $Gb = "{0:n2}" -f ($event.SourceEventArgs.NewEvent.targetinstance.FreeMegabytes/1024);
                                                                        Send-MailMessage        -SmtpServer XXX.X.XX.XXX -From 'SQLExecutive@contoso.com' -To  'laerte.junior@contoso.com.br' -Subject "Espaco em Disco Abaixo de $($SpaceGB) GB - Servidor  $($event.SourceEventArgs.NewEvent.targetinstance.__SERVER)" -Body " Volume $($event.SourceEventArgs.NewEvent.targetinstance.name) com $Gb GB";
                                                                        Write-EventLog -LogName MonitorLowDiskSpace -EventId 01 -Message "Espaco em Disco Abaixo de $($SpaceGB) GB - Servidor  $($event.SourceEventArgs.NewEvent.targetinstance.__SERVER) Volume $($event.SourceEventArgs.NewEvent.targetinstance.name) com $Gb GB"  -Source Poshevent -EntryType Warning -Category 1 -ComputerName $Hostname
  
                                                                    } | Out-Null
                               $log = "Event registered in Volume $($Volume) computer $($Hostname)" 
  
               } catch {
                               $Log = "Failed to Register WMI Event on {0} volume {2}. {1}" -f $($Hostname),$($Volume),$($_.Exception.Message)
               }
               $log | Out-File "$Env:TEMP\MsgEvents$(Get-date -format 'ddMMyyyy').log" -Append
}
Send-MailMessage        -SmtpServer XXX.X.XX.XXX -From 'SQLExecutive@contoso.com' -To  'laerte.junior@contoso.com.br' -Subject "Eventos de Espaco em Disco" -Body "Script de Registro de evento em espaco em disco executado no servidor $($Hostname). Verificar Arquivo de log $Env:TEMP\MsgEvents$(Get-date -format 'ddMMyyyy').log ";
  
  

Lets see some things :

First I need to find the volumes, that is because I am using Win32_Volume and properties DriveType = 3 and SystemVolume = false and FileSystem = ‘NTFS’.
The drive type = 1 show only Local Disk, System Volume = false to not use system volume and FileSystem = ‘NTFS’ only want the NTFS formatted volumes.
Then I am using Win32_PerfFormattedData_PerfDisk_LogicalDisk class to get the data from this volumes .

in this line
$Volume = ($($_.name).TrimEnd(“\”)).replace(“\” ,”\\”)

I formated the volume to take off the ‘\’ at the end of the volume, because the mount points is showed as d:\something\ and I change the ‘\’ to ‘\\’ because ‘\’ is a special char.

in this line
$SourceIdentifier = (($($_.name)).replace(“\” ,”")).replace(“:”,”")

I cleaned the volume name to concatenate in –SourceIdentifier “LowDiskSpace$($SourceIdentifier)”. This way I haveJob Name each event registered

Then I createed a Log File with messsage successful or failed and put at $env:temp
$log | Out-File “$Env:TEMP\MsgEvents$(Get-date -format ‘ddMMyyyy’).log” -Append

This way I do not have a email to each event registered or not, juts one email to see the log file at $Env:TEMP\MsgEvents$(Get-date -format ‘ddMMyyyy’).log

Also Created a new Entry in EventViewer called MonitorLowDiskSpace to log the data into EventViewer too.

New-EventLog MonitorLowDiskSpace -source PoshEvent

And was working fine, but in the first problem with disk space a message each 5 seconds was delivery to my email. (within clause to 5)
Then, I changed to 30 minutes (1800 seconds). But, other problem. when the low disk space happened again, the first email only was delivery after 30 minutes. Bummer.
So, I decided to create my own alert suppression.

Handle with alert Suppression

My Idea is simple. Just create a log file with the date and hour that the email was sent and then in the next execution I test if the minutes between current date (get-date) and the data logged into the file is greater than X minutes. (Pareameter $Time). If it is, send email again and update the file with the current date time. No, just ignore it.

So the code is :

#New-EventLog MonitorLowDiskSpace -source PoshEvent 
Param  



 

 

 
$SpaceGB =  
 

 

 





 









 









 





 


( [ValidateNotNullOrEmpty()] $Hostname, [ValidateNotNullOrEmpty()] $Space [ValidateNotNullOrEmpty()] $Time 6: ) 8: #$Hostname = 'Server01' #$Space = 2048 10: #Time 10 -minutes $Space / 1024 12: Get-WmiObject -computername $Hostname ` -query " select Name from Win32_Volume where DriveType = 3 and SystemVolume = false and FileSystem = 'NTFS'" | foreach { 14: try { 16: $Volume = ($($_.name).TrimEnd("\")).replace("\" ,"\\") $SourceIdentifier = (($($_.name)).replace("\" ,"")).replace(":","") $SourceIdentifier = "LowDiskSpace$($SourceIdentifier)" $FileName = "$($Env:TEMP)\$($SourceIdentifier).log" $pso = new-object psobject -property @{FileName=$FileName;Time=$Time} 22: $query = "Select * from __instanceModificationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfDisk_LogicalDisk' and targetinstance.Name=`'$($Volume)`' AND TargetInstance.freemegabytes < $space" Register-WMIEvent -ComputerName $Hostname ` -Query $Query ` -SourceIdentifier $SourceIdentifier ` -Action { $SendEmail = $true if (Test-Path $event.MessageData.FileName -PathType Leaf ) { $SendEmail = ((New-TimeSpan -Start ([datetime]::parseexact((get-content $event.MessageData.FileName),'yyyy-MM-dd HH:mm:ss',$null)) -End (get-date -format "yyyy-MM-dd HH:mm:ss")).totalminutes -ge $event.MessageData.Time) ; } 32: if ($SendEmail) { $Gb = "{0:n2}" -f ($event.SourceEventArgs.NewEvent.targetinstance.FreeMegabytes/1024); Send-MailMessage -SmtpServer XXX.X.XX.XXX -From 'SQLExecutive@contoso.com' -To 'laerte.junior@contoso.com.br' -Subject "Espaco em Disco Abaixo de $($SpaceGB) GB - Servidor $($event.SourceEventArgs.NewEvent.targetinstance.__SERVER)" -Body " Volume $($event.SourceEventArgs.NewEvent.targetinstance.name) com $Gb GB"; Write-EventLog -LogName MonitorLowDiskSpace -EventId 01 -Message "Espaco em Disco Abaixo de $($SpaceGB) GB - Servidor $($event.SourceEventArgs.NewEvent.targetinstance.__SERVER) Volume $($event.SourceEventArgs.NewEvent.targetinstance.name) com $Gb GB" -Source Poshevent -EntryType Warning -Category 1 -ComputerName $Hostname get-date -format 'yyyy-MM-dd HH:mm:ss' | Out-File $event.MessageData.FileName -Force } } | Out-Null $log = "Event registered in Volume $($Volume) computer $($Hostname)" 42: } catch { $Log = "Failed to Register WMI Event on {0} volume {2}. {1}" -f $($Hostname),$($Volume),$($_.Exception.Message) } $log | Out-File "$Env:TEMP\MsgEvents$(Get-date -format 'ddMMyyyy').log" -Append } 48: Send-MailMessage -SmtpServer XXX.X.XX.XXX -From 'SQLExecutive@contoso.com' -To 'laerte.junior@contoso.com.br' -Subject "Eventos de Espaco em Disco" -Body "Script de Registro de evento em espaco em disco executado no servidor $($Hostname). Verificar Arquivo de log $Env:TEMP\MsgEvents$(Get-date -format 'ddMMyyyy').log "; 50:

Big Thanks to Shay Levy to help in my datetime questions

Download LowDiskSpace.ps1

#PowerShellLifeStyle

Slides e Scripts–24HOPLATAM–Hey PowerShell, voce pode me notificar ?

Laerte Junior — Thu, 20 Oct 2011 08:36:07 +0000

Pessoal, segue os scripts e slides da minha sessão

Hey PowerShell , você pode me notificar ?

Eu coloquei meu modulo de funções também. Basta voce colocar no seu profile e pronto. No caso da send-smtpemail, basta trocar dentro dela o usuario e a senha em :

#sua credencial aqui
$mailer.Credentials = New-Object System.Net.NetworkCredential(“Nome“, “senha“); # Put username without the @GMAIL.com or – @gmail.com

Abs

Download

#PowerShellLifeStyle

Speaking 24HOPLATAM–Notifications with PowerShell and WMI/WMI Server Events

Laerte Junior — Sat, 15 Oct 2011 21:43:40 +0000

Nos dias 19 e 20 de outubro acontecerá o maior evento gratuito online da América Latina. O 24 hours of PASS LATAM , o mesmo contará com uma grade cheia de novidades sobre o SQL Server “Denali” (versão CTP3). Haverá diversos palestrantes desde Espanha, Costa Rica, Venezuela, Guatemala, Argentina, Brasil e etc.

Eu vou falar dia 19 as 11:00 da manhã (Brasilia Time) 09:00 CDT (Mexico), sobre notificações de eventos usando PowerShell e WMI/WMI Server Events. Veremos o que é WMI , WQL, Event Query Language, quais suas variações e como usar. Depois será codigo, codigo, codigo…

Inscrições:24 Horas PASS LATAM – Denali “Camino al 2012″

Grade do Evento e Fonte :

Blog da Cibelle Castro

Comparing and Scripting SQL Server Database Objects using PowerShell and SQLPSX

Laerte Junior — Fri, 14 Oct 2011 23:55:26 +0000

Today I had to compare two databases on different servers, looking for views on the server1 and not were in a server2.

I used the compare-object cmdlet :

$Source = Get-SqlDatabase -sqlserver ServerSource -dbname DB1 | Get-SqlView 
$Dest = Get-SqlDatabase -sqlserver ServerDest -dbname DB2 | Get-SqlView
 
$DiffViews = Compare-Object -DifferenceObject $dest `
                            -ReferenceObject $Source `
                            -Property Name | ?{$_.SideIndicator -eq '<='} | % {$_.Name}
                            
$scriptingOptions = New-SqlScriptingOptions
$scriptingOptions.Permissions = $true
$scriptingOptions.IncludeIfNotExists = $true
get-sqldatabase -sqlserver ServerSource-dbname DB2| Get-SqlView | ?{$DiffViews -contains $_.name} | Get-SqlScripter -scriptingOptions $scriptingOptions | Out-File c:\temp\DiffViews.sql
 

Then, was just use Get-SqlScripter to Script the difference and out to c:\temp\DiffViews.sql

Thanks to Sir Chad Miller to help me in the final script

Simple, Fast and Clean. Classic PowerShell

#PowerShellLifeStyle

PowerShell and WMI Server Events (SQL Server)–Who is running DBCC commands on my servers ?

Laerte Junior — Thu, 13 Oct 2011 23:19:57 +0000

This morning, in the early hours of the day, we had some kind of weird happenings in our SAP environment.

The system showed a massive slowdown, and the BASIS asked our help to find the problem. We have seen that several DBCC CHECKDB command, DBCC TRACEON were running at the same time, something like a 30 dbcc checkdbs

We Killed the sessions and after a few minutes they came back again. Well, we needed to know where these commands were coming, any SAP service or not.

From my machine, in the cluster, I just used ONE PowerShell Line

Register-WMIEvent  -ComputerName RemoteServer `
                   -Namespace 'root\Microsoft\SqlServer\ServerEvents\MSSQLSERVER' `
                   -Query "select * from AUDIT_DBCC_EVENT" `
                   -Action { Send-MailMessage  -SmtpServer 111.1.11.111 -From 'SQLExecutive@contoso.com.br' -To 'grpDBA@contoso.com.br' `
                                               -Subject 'Auditoria Comandos DBCC Servidor SQLECC' `
                                               -Body "ApplicationName : $($event.SourceEventArgs.NewEvent.ApplicationName) `n
                                                       ServerName : $($event.SourceEventArgs.NewEvent.ServerName)`n 
                                                       Database ID : $($event.SourceEventArgs.NewEvent.Databaseid) 
                                                       Database Name : $($event.SourceEventArgs.NewEvent.DatabaseName ) 
                                                       DBUserName : $($event.SourceEventArgs.NewEvent.DBUserName ) 
                                                       HostName : $($event.SourceEventArgs.NewEvent.HostName) 
                                                       LoginName : $($event.SourceEventArgs.NewEvent.LoginName) 
                                                       NTDomainName : $($event.SourceEventArgs.NewEvent.NTDomainName) 
                                                       NTUserName : $($event.SourceEventArgs.NewEvent.NTUserName) 
                                                       SPID : $($event.SourceEventArgs.NewEvent.spid)`n
                                                       SessionLoginName : $($event.SourceEventArgs.NewEvent.SessionLoginName)`n 
                                                       Start Time : $([Management.ManagementDateTimeConverter]::ToDateTime($event.SourceEventArgs.NewEvent.StartTime))`n 
                                                       TextData : $($event.SourceEventArgs.NewEvent.TextData)"
                                                        
                   }

Just register the event in the AUDIT_DBCC_EVENT Class and be happy.!!!

ha..after that, we need to be notified on dbcc traceon only…, juts change the query to :

"select * from AUDIT_DBCC_EVENT where textdata like '%Traceon%'"

Simple, Faster and Clean !!!! Classic PowerShell !!!

#PowerShellLifestyle !!!

Slides and PowerShell Scripts–My SQLBITS 9 Session

Laerte Junior — Sat, 08 Oct 2011 11:42:54 +0000

Hi Guys, although Murphy had come grace me with your presence in my session, my VM crashes online (was beautiful), follows the slides and scripts.

Download – SQLBITS9 – PowerShell and WMI-WMI Server Events

#PowerShellLifeStyle

SQLBITS – Unforgettable

Laerte Junior — Fri, 07 Oct 2011 22:46:06 +0000

It’s been 4 days thinking about what to write. Actually I thought of other words not to be unforgettable, fantastic, amazing.
But I was impressed not only the event itself, with the organization and level of the sessions, but for the people.

My second day in Liverpool I went to Redgate´s HQ. I have the pleasure and the honor to meet my friends Andrew Clarke, Chris Massey, Tony, Annabel, Sarah ..Phil Factor (hahaha I am pretty sure that I know who is him)

Guys, Redgate is a AWESOME Company to work…in fact it is not a company, it is a family .. that was my feeling about.. and in Cambridge…what a beatiful place.

When I come to the Hotel,first SQLBITS Day, Jonathan and Annete Allen was waiting for me and and were my host in the entire event.

Then I meet in PERSON Allen White, Neil Hambly,Kevin Kline, Steve Jones, Aaron Bertrand, Andy Leornard, Tobias,Karla Landrum, Mark Broadbent, Allan Mitchell, Simon Sabin, Chris Testa-O´Neill, James Rowland-Jones, Christian Bolton, Jen Stirrup, Hannah Jeremy and the guys from Redgate Stande. Allen White in his session mentioned me..and I was in there HAAAAAAAAAA !!!!!!

HOLY Mother…and a lot of great guys from the SQLBITS family.

I just can say that this week remained in my memory forever.

Chistian Bolton, Jonathan Allen, Steve Jones and Allen White ..MANY thanks for the kind words about my session. Chistian , no words to thanks what you said to me Man..and coming from you..no words. Jonathan thanks for the kind words as well and laugh at my stupid jokes

Jonathan and Annette. You guys are wonderful. if the world were made by people like you, would be so better. I am and I will be eternally grateful for everything that you did for me. You guys definitely have a big part in my heart…forever.

I do not know if I’ll be back in the next as speaker, but I was in that and was one of the greatest honors in my career. Thanks for the SQLBITS team for believe in me. In the next I will be there, even as speaker or not. It is a SHOW…literally a SQL Server SHOW !!!!

The trip was tiring, but I will do it again as many times as I can.

Some picts

Creating your Monitoring Server With PowerShell and WMI/Server Events

Laerte Junior — Sat, 24 Sep 2011 00:31:40 +0000

Well guys, this is my next S-T Article and now it is in the magic hands of Super Chris Massey to review (soon will be published) .

As I did a link to a video in the article, if you want, you can watch it.

In this Article I will cover how to setup a monitoring server using temporary event consumers and permanent event consumers (using Trevor´s PowerEvents Module).

I will show a solution using temporary event consumers in my session in SQLBITS as well.

I beleive you will understand the idea. (or at least enjoy the good music)

Watch the video.

#PowerShellLIfeStyle

PowerShell and SQL Server Events–Changes in Database Options

Laerte Junior — Thu, 15 Sep 2011 22:32:49 +0000

Today my good friend Marcos Freecia (@sqlfreccia) asked if there is some way to be notified if a database is taking off line.

I did not found any event to do this (if someone knows please tell me), BUUUUT every changes in the database options is logged in the SQL Server ERRORLOG and there is an event fired to a ERRORLOG.

Then was just find what error id is for the database options (5084) – Errors 5000 – 5999 and register the event :

 
$query = "select * from  ERRORLOG where Error = 5084"
Register-WMIEvent     -SourceIdentifier "ErrorLogevent" `
                    -Namespace 'root\Microsoft\SqlServer\ServerEvents\MSSQLSERVER' `
                    -Query $query `
                    -Action {    ipmo functions;    
                                Send-SMTPmail     -smtpserver 'smtp.mail.yahoo.com.br' `
                                                -from 'juniorlaerte@yahoo.com.br' `
                                                -to 'laertejuniordba@hotmail.com' `
                                                -subject 'Event Notification - Database Options' `
                                                -body     "ApplicationName  : $($Event.SourceEventArgs.NewEvent.ApplicationName) `n
                                                         Error            : $($Event.SourceEventArgs.NewEvent.Error) `n
                                                         ServerName       : $($Event.SourceEventArgs.NewEvent.ServerName) `n
                                                         SessionLoginName : $($Event.SourceEventArgs.NewEvent.SessionLoginName) `n
                                                         SPID             : $($Event.SourceEventArgs.NewEvent.SPID) `n
                                                         SQLInstance      : $($Event.SourceEventArgs.NewEvent.SQLInstance) `n 
                                                         Message          : $($Event.SourceEventArgs.NewEvent.textdata)
                                                         StartTime           : $([Management.ManagementDateTimeConverter]::ToDateTime($Event.SourceEventArgs.NewEvent.StartTime))"
 
                                                        
                            }

Notice that now I’m specifying the event identifier (SourceIndentifier parameter) to unregister

Now, every change in the databases will be triggered when logged in the SQL Server ERRORLOG.

But what if I want every time that my server are restarted, this event is registered :

Thers is some ways. You can do it in by SQL Server Alerts, but you will depend the SQL Agent to send an email.

You can use the awesome project from Trevor Sullivan (@pcgeek85)

PowerEvents for Windows PowerShell

What is PowerEvents?

PowerEvents is a Windows PowerShell v2.0 module designed to facilitate the ease of creating, updating, and deleting WMI (Windows Management Instrumentation) permanent event registrations. PowerEvents makes it easy to create WMI event filters (define the events you want to capture) and event consumers (responders to events), and then bind them together to initiate the flow of events. By leveraging permanent event registrations, you can perform advanced monitoring functions on a workstation or server, that would otherwise require implementation of an enterprise monitoring product. Because WMI is incredibly vast in the information it provides, very detailed monitoring can be performed using almost any of the WMI objects that exist on a computer.

What are WMI Permanent Event Registrations?

A little-known capability of the WMI service, is its capability to create a permanent registration (listener) for events, and then automatically respond to those events. At a very basic level, it’s “if X happens, do Y” but in this case, it’s all built into WMI, without the need for any additional software.

In other words, you will switch from temporary consumers to a permanent consumer.

Or you can create a .ps1 with this script, put into a .bat file and excute using :

powershell.exe -noexit -windowstyle hidden  -command "c:\temp\errorlogevent.ps1"

And use the noexit and windowstyle to hidden PowerShell.exe Console Help

Then, you can put into your server startup options.

and to unregister your event :

Unregister-Event ErrorLogevent   

where ErrorEventLog is the name that I put in parameter SourceIdentifier in the Register-WMIEvent

Watch the video

The register-wmievent run a job in another runspace, then to find bugs in the code is a bit complicated. In my SQLBITS session I will show how to use the variable $Event and how to solve these bugs.

See you in Liverpool guys, do not miss my session, I am sure that you’ll like it

#PowerShellLifeStyle

SAFEPEAK – SQL Server Performance Contest 2011

Laerte Junior — Wed, 14 Sep 2011 20:37:16 +0000

Hey, do you want to win a IPAD2 and even better, tell your SQL Server Performance Story ?

Just submit your success case on SAFEPEAK Website, and finger crossed.

Our good friend Robert Pearl is the Contest Supervisor and it is a great oportunity to share (or even $hell) your experience with the SQL Server community.

I alread sent my story.. and you ?. Just click in the link below and ..luckly be happy

Go.Go.Run Forrest Run !!!!!

SAFEPEAK SQL Server Performance Contest 2011