rblog

Breaking the law!

Heading towards Oslo in the Toyota Hi Class, who my father-in-law have owned for almost 19 years. Today we will hand it over to the new owner, so I had to break the law and film while driving to capture the sound and feeling – the wipers making noise disturbing the sound from the stereo playing Swedish dansband music. Epic!
[video:youtube:Lyugvr1lfiU]
Want the whole song?
[video:youtube:_sFbjP2il4U]

Windows – Search for files using WQL

Needed a script that searches a the entire disk for Java dump files (core, snap, heap, javacore). In addition the files should not be older than X days to limit the search results. Since I have decided that all scripts I create that is related to server maintenance should be written in Powershell I just had to roll up my sleeves and head on to Google to be inspired. Below you can see the result.


param (
    [string]$logFile = $(throw "******************************`n" + 
			"Custom error:`nMissing required parameter -logFile." +
			"`nSpecify name without full path`n******************************`n`n")    
)
### Uncomment line below to enable debug
#$DebugPreference = "Continue"

# The script will search the d-drive by default
# If d does not exist it will search the c drive 
$drive = "d:"
If (!(Test-Path d:))
{
	$drive = "c:"
	If (!(Test-Path c:)) {
		throw "Did not find d or c-drive, script will cannot continue"
	}
}
$fullLogFile = Join-Path "$drive\temp\" "$logFile";
Start-Transcript $fullLogFile;


####
# Fixed variables
####
$notOlderThanDays = -7 # Change this to whatever amount of time you are looking for

$wmiQuery = "Select * from CIM_DataFile where Drive='$drive' AND FileName Like '{0}' AND Extension='{1}' AND CreationDate >= '{2}'"

# E.g core.20131030.052140.5448.0002.dmp
$core = "core%"
$coreExt = "dmp"

# E.g Snap.20131030.052140.5448.0001.trc
$snap = "Snap%"
$snapExt = "trc"

# E.g heapdump.20131030.052140.5448.0004.phd
$heap = "heapdump%"
$heapExt = "phd"

# javacore.20131030.052140.5448.0003.txt
$javacore = "javacore%"
$javacoreExt = "txt"

$date = Get-Date # Current time
$date = $date.AddDays($notOlderThanDays) 
$creationdate = Get-Date $date -Format G # This format is the format that the WMI commandlet likes

#####
# Start the fun
#####

# Corefiles
$runQuery = [String]::format($wmiQuery,$core,$coreExt,$creationdate)
Write-Debug "Start searching for core files"
Write-Debug $runQuery
Get-WmiObject -Query $runQuery | select Name

# Snapfiles
$runQuery = [String]::format($wmiQuery,$snap,$snapExt,$creationdate)
Write-Debug "Start searching for snap files"
Write-Debug $runQuery
Get-WmiObject -Query $runQuery

# Heapdumps
$runQuery = [String]::format($wmiQuery,$heap,$heapExt,$creationdate)
Write-Debug "Start searching for heap files"
Write-Debug $runQuery
Get-WmiObject -Query $runQuery

# Javacore
$runQuery = [String]::format($wmiQuery,$javacore,$javacoreExt,$creationdate)
Write-Debug "Start searching for javacore files"
Write-Debug $runQuery
Get-WmiObject -Query $runQuery

Stop-Transcript