Hi PowerShell experts!
I am currently creating a PowerShell eventing script that will be registering events on my local computer and monitoring win32_service and the __InstanceModificationEvent on remote computers. Currently, here is the script and it is working:
# Variables
[string]$RemoteComputer = "computerName"
# Here is the WQL to query for modifications on the win32_service every 2 seconds...
# Interpretation: Get all events (Select *) from the instancemodificationevent every 2 seconds where the instance being modified is a win32_service
[string]$Query = "SELECT * FROM __InstanceModificationEvent WITHIN 2 WHERE TargetInstance ISA 'win32_service'"
# Register the query and event on the local computer to the remote computer
Register-WmiEvent -Query $Query -SourceIdentifier "ServiceModificationEventWatcher" -ComputerName $RemoteComputer -Action {
[string]$EventTime = [datetime]::FromFileTime($Event.SourceEventArgs.NewEvent.TIME_CREATED).ToString()
[string]$ServiceEventState
[string]$ServiceName = $Event.SourceEventArgs.NewEvent.TargetInstance.Name
[string]$Server = $Event.SourceEventArgs.NewEvent.TargetInstance.__SERVER
if($Event.SourceEventArgs.NewEvent.TargetInstance.Started -eq $true)
{
$ServiceEventState = "started"
}
else
{
$ServiceEventState = "stopped"
}
Write-Host "The service, $ServiceName, was $ServiceEventState on $Server on $EventTime."
}
Now, I want to register multiple events on my SharePoint farm to watch crucial SharePoint services (ultimately, I will edit the action block to start any stopped SharePoint services) and do stuff when the event is activated. My question is, would it be better to register all the events on my development server or invoke this command to my ps remote-enabled SharePoint servers? What is the performance hit on registering all events onto my server versus registering each event on each server?
Thanks,
Hha89