How can I extract and count Client IDs from a WSUS log with PowerShell?
Asked by
MistyCanvas42
I'm troubleshooting WSUS and need to determine how many machines are experiencing a particular error. The log contains entries such as:
2026-09-10 18:36:13.084 UTC Warning w3wp.334 SoapUtilities.CreateException ThrowException: actor = http://server.example.com:8530/CLIENTWEBSERVICE/client.asmx, ID=94d8e636-29bc-4bc8-8958-79e5e189455e, ErrorCode=InvalidParameters, Message=parameters.OtherCachedUpdateIDs, Client=13ef38ff-b877-4d9a-9b1e-cf190d8fc801
I'd like to extract the value after Client= and then group or count the entries by Client ID. Is there an existing PowerShell approach for parsing the log and identifying the affected machines?
Answers
If you only need the Client value, a named capture is enough. Read each line and match the text after Client= up to the next comma or whitespace:
$clients = foreach ($line in Get-Content 'C:PathSoftwareDistribution.log') {
if ($line -match 'Client=(?[^,s]+)') {
$Matches.Client
}
}
$clients | Group-Object | Sort-Object Count -Descending
That gives you one group per client ID, with Count showing how many matching log entries each client generated. If you only want the number of distinct clients, use:
($clients | Sort-Object -Unique).Count
Reply to this answer
For a reusable parser, match the timestamp and the key/value section, then turn the pairs into object properties. This lets you filter by Client, ErrorCode, Message, or any other field:
$pattern = '(?xm)^(?S+s+S+s+UTC)s+(?w+)s+(?.*?:)s+(?.*)$'
$logs = foreach ($line in Get-Content 'C:PathSoftwareDistribution.log') {
if ($line -match $pattern) {
$properties = [ordered]@{}
foreach ($pair in ($Matches.Pairs -split 's*,s*')) {
$key, $value = $pair -split 's*=s*', 2
$properties[$key] = $value
}
[pscustomobject]@{
Date = $Matches.Date
Severity = $Matches.Severity
Exception = $Matches.Exception
Client = $properties.Client
Error = $properties.ErrorCode
Message = $properties.Message
Actor = $properties.Actor
Data = [pscustomobject]$properties
RawLine = $line
}
}
}
$logs | Group-Object Client | Sort-Object Count -Descending
PaperKite88: The important detail is using `-split 's*=s*', 2`; the limit of 2 prevents values containing an equals sign from being split incorrectly. The simpler Client-only regex is preferable if no other fields are needed.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MistyCanvas42: That makes sense—the capture returns each Client ID, and Group-Object handles the counting. I was initially looking for a parser that would also expose the other fields.