I'm troubleshooting WSUS and need to determine how many machines are experiencing a particular error. The log contains entries such as:
2026-09-10 18:36:13.084 UTC Warning w3wp.334 SoapUtilities.CreateException ThrowException: actor = http://server.example.com:8530/CLIENTWEBSERVICE/client.asmx, ID=94d8e636-29bc-4bc8-8958-79e5e189455e, ErrorCode=InvalidParameters, Message=parameters.OtherCachedUpdateIDs, Client=13ef38ff-b877-4d9a-9b1e-cf190d8fc801
I'd like to extract the value after Client= and then group or count the entries by Client ID. Is there an existing PowerShell approach for parsing the log and identifying the affected machines?
2 Answers
For a reusable parser, match the timestamp and the key/value section, then turn the pairs into object properties. This lets you filter by Client, ErrorCode, Message, or any other field:
$pattern = '(?xm)^(?S+s+S+s+UTC)s+(?w+)s+(?.*?:)s+(?.*)$'
$logs = foreach ($line in Get-Content 'C:PathSoftwareDistribution.log') {
if ($line -match $pattern) {
$properties = [ordered]@{}
foreach ($pair in ($Matches.Pairs -split 's*,s*')) {
$key, $value = $pair -split 's*=s*', 2
$properties[$key] = $value
}
[pscustomobject]@{
Date = $Matches.Date
Severity = $Matches.Severity
Exception = $Matches.Exception
Client = $properties.Client
Error = $properties.ErrorCode
Message = $properties.Message
Actor = $properties.Actor
Data = [pscustomobject]$properties
RawLine = $line
}
}
}
$logs | Group-Object Client | Sort-Object Count -Descending
If you only need the Client value, a named capture is enough. Read each line and match the text after Client= up to the next comma or whitespace:
$clients = foreach ($line in Get-Content 'C:PathSoftwareDistribution.log') {
if ($line -match 'Client=(?[^,s]+)') {
$Matches.Client
}
}
$clients | Group-Object | Sort-Object Count -Descending
That gives you one group per client ID, with Count showing how many matching log entries each client generated. If you only want the number of distinct clients, use:
($clients | Sort-Object -Unique).Count
That makes sense—the capture returns each Client ID, and Group-Object handles the counting. I was initially looking for a parser that would also expose the other fields.
The important detail is using `-split 's*=s*', 2`; the limit of 2 prevents values containing an equals sign from being split incorrectly. The simpler Client-only regex is preferable if no other fields are needed.