Tuesday, January 29, 2013

Deleting logs with PowerShell and Scheduled Tasks making the mundane a little less painful

Delete all the things.

This is a new take on an age old problem purging or rotating outdated logging information from servers and workstations alike. I am sure there are hundreds if not thousands of batch files and PowerShell scripts that delete old log files, but what if someone wrote one that not only deletes the old files but is also self aware. Ok.. Maybe not self aware and a far cry from Skynet, but how about one that allows you to schedule and un-schedule it self using the provided parameters as a Windows Scheduled Task.

Well look no further someone has; drop the snippet below into a file called Delete-Logs.ps1 and you too can delete all the things with ease. I have tested this script with Windows 7 and Server 2008 using PowerShell 2.0. While researching I discovered there are also some convenience cmdlets for task scheduler allowing you to manage tasks however, for compatibility reasons I decided stick with schtasks.exe. You will notice I had to remove the path characters from the task name :.(. I had to remove them because of a bug limiting special characters from the scheduled task name.

# Parameters
# -Path A valid absolute path to a log folder or collection of folders script will recursively scan folders
# -Include A wildcard pattern used to include files for consideration 
# -Days Number of days before deleting file from folder
# -Schedule Creates a scheduled task using the provided path, include, and days parameter. Task will run as system user and execute every night at 12:00 AM every 
#  number of days provided in days parameter
# -Unschedule Removes scheduled task that was previously configured for the provided path
# Examples
# Run as stand alone
# .\Delete-Logs.ps1 -Path:'D:\Logs' -Days:4
# Schedule Windows Task
# .\Delete-Logs.ps1 -Path:'C:\Temp' -Include:'*.tmp' -Days:7 -Schedule
# Unschedule Windows Task
# .\Delete-Logs.ps1 -Path:'C:\Temp' -Include:'*.tmp' -Days:7 -Unschedule
Param ($Path='C:\Logs',[string]$Include='*.log', [int]$Days=30, [switch]$Schedule,[switch]$Unschedule)
$Path = New-Object PSObject -Property:@{ Value = $Path; Name = $($Path -replace '\:\\|\\',' ')}
 Invoke-Expression "C:\Windows\System32\schtasks.exe /create /tr `"`"$PSHome\powershell.exe`" -File '`"'$($MyInvocation.MyCommand.Path)'`"' -Path '`"'$($Path.Value)'`"' -Include '`"'$Include'`"' -Days $Days`" /tn `"Rotate $($Path.Name) every $Days days`" /sc daily /mo $Days /st 00:00 /ru SYSTEM"
 Invoke-Expression "C:\Windows\System32\schtasks.exe /delete /tn `"Rotate $($Path.Name) every $Days days`" /F" 
 $count = 0;
 $start = Get-Date;
 Write-Host "Begin log rotation of $($Path.Value) at $start"
 Get-ChildItem $($Path.Value) -Recurse -Include:$Include | Where-Object {($_.CreationTime -le $(Get-Date).AddDays(-$Days))} | ForEach-Object {
  $date = Get-Date;
  $age = $date.ticks - $_.CreationTime.ticks;
  $age = New-Object -TypeName:'TimeSpan' -ArgumentList:$age;
  Write-Host "Rotating $_ at $date file was $age old";
  Remove-Item $_ -Force;
 $end = Get-Date;
 $duration = $end - $start
 Write-Host "End log rotation of $($Path.Value) at $end $count file(s) were rotated in $duration"