Exchange White Space
A common posting on PowerShell newsgroups and forums from Exchange administrators is how to parse event id 1221 from the Exchange server application log file. A typical event message would look like:
Event Type: Information
Event Source: MSExchangeIS Mailbox Store
Event Category: General
Event ID: 1221
Date: 10/01/2009
Time: 13:27:31
User: N/A
Computer: SERVER
Description: The database "First Storage Group\Mailbox Store (SERVER)" has
7.2 megabytes of free space after online defragmentation has terminated.
Usual solutions are based on regular expressions to process the message description and extract the name of the database(s) and the number of free megabytes. The bellow code gets the information and doesn’t require any knowledge of regular expression, though I strongly recommend any sys admin getting to know regex!
The message text is a fixed message with two placeholders for the database name and the free megabytes:
The database "<name>" has “<number>” megabytes of free space after online defragmentation has terminated.
We can access the message placeholder values with the insertion strings array property of the Windows NT event object:
Get-WMIObject Win32_NTLogEvent -ComputerName SERVER -Filter "LogFile='Application' AND `
EventCode=1221 AND TimeWritten>='$Start' AND TimeWritten<='$End'" | `
Select-Object ComputerName,InsertionStrings
ComputerName InsertionStrings
------------ ----------------
SERVER {10351, First Storage Group\SG1 (SERVER)}
SERVER {6043, Second Storage Group\SG2 (SERVER)}
SERVER {881, Third Storage Group\SG3 (SERVER)}
As you can see, the free megs are positioned at index 0 and the database name at 1. With Get-ExchangeWhiteSpace we can pass a computer name and get white space information for the previous day.
function Get-ExchangeWhiteSpace {
param(
$ComputerName = $(throw "ComputerName cannot be empty.")
)
# Convert Dates to WMI CIM dates
$tc = [System.Management.ManagementDateTimeconverter]
$Start =$tc::ToDmtfDateTime( (Get-Date).AddDays(-1).Date )
$End =$tc::ToDmtfDateTime( (Get-Date).Date)
# Create two claculated properties for InsertionStrings values
$DB = @{Name="DB";Expression={$_.InsertionStrings[1]}}
$FreeMB = @{Name="FreeMB";Expression={[int]$_.InsertionStrings[0]}}
Get-WMIObject Win32_NTLogEvent -ComputerName $ComputerName -Filter "LogFile='Application' AND EventCode=1221 AND TimeWritten>='$Start' AND TimeWritten<='$End'" | Select-Object ComputerName,$DB,$FreeMB | Sort-Object FreeMB –Unique –Descending
}
PS > Get-ExchangeWhiteSpace -ComputerName SERVER | Format-Table -AutoSize
ComputerName DB FreeMB
------------ -- ------
SERVER First Storage Group\SG1(SERVER) 10351
SERVER Second Storage Group\SG2(SERVER) 6043
SERVER Third Storage Group\SG3(SERVER) 881
