I'm troubleshooting WSUS errors and need a PowerShell script that can parse SoftwareDistribution.log, extract the Client GUID from entries like `Client=13ef38ff-b877-4d9a-9b1e-cf190d8fc801`, and group or count the results. The goal is to identify how many machines are experiencing this issue. Ideally, the parser could also expose fields such as the error code, message, timestamp, severity, and actor.
1 Answer
You can match the overall log format, split the comma-separated key/value section, and turn each line into an object. That gives you properties you can filter, group, and count later:
```powershell
$regex = @'
(?xm)^
(?S+sS+sUTCs)
(?w+)s
(?.*?:)s
(?.*)
$'
'@
$logs = foreach ($line in Get-Content 'C:PathSoftwareDistribution.log') {
if ($line -match $regex) {
$props = [ordered]@{}
$Matches.Pairs -split 's*,s*' | ForEach-Object {
$key,$value = $_ -split 's*=s*',2
$props[$key] = $value
}
[pscustomobject]@{
Error = $props.ErrorCode
Message = $props.Message
Actor = $props.Actor
Client = $props.Client
Date = $Matches.DateTime
Severity = $Matches.Severity
Exception = $Matches.Exception
}
}
}
$logs | Group-Object Client | Sort-Object Count -Descending
```
The resulting objects can also be filtered by `Error`, `Message`, or `Severity` before grouping.
Since the regular expression is already doing the line matching, you can also use a `switch -Regex -File` loop instead of manually iterating over `Get-Content`. The key part remains splitting the captured pairs with `-split 's*,s*'` and then splitting each pair only on its first equals sign.