Optimize PowerShell Performance and Memory Consumption

Question

The PowerShell script below queries the Security event log on one or more servers for events with id 4663. When trying to retrieve all audit events for event id 4663 with the following code the computer throws the following exception: how can we to optimize this PowerShell? So I just want to fetch security event log based on specific AD Users instead of all of users. Otherwise I want to retrieve what I need.

$server = "HOSTNAME"
$out = New-Object System.Text.StringBuilder
$out.AppendLine("ServerName,EventID,TimeCreated,UserName,File_or_Folder,AccessMask")
$ns = @{e = "http://schemas.microsoft.com/win/2004/08/events/event"}
foreach ($svr in $server)
    {    $evts = Get-WinEvent -computer $svr -FilterHashtable @{logname="security";id="4663"} -oldest

    foreach($evt in $evts)
        {
        $xml = [xml]$evt.ToXml()

        $SubjectUserName = Select-Xml -Xml $xml -Namespace $ns -XPath "//e:Data[@Name='SubjectUserName']/text()" | Select-Object -ExpandProperty Node | Select-Object -ExpandProperty Value

        $ObjectName = Select-Xml -Xml $xml -Namespace $ns -XPath "//e:Data[@Name='ObjectName']/text()" | Select-Object -ExpandProperty Node | Select-Object -ExpandProperty Value

        $AccessMask = Select-Xml -Xml $xml -Namespace $ns -XPath "//e:Data[@Name='AccessMask']/text()" | Select-Object -ExpandProperty Node | Select-Object -ExpandProperty Value

        $out.AppendLine("$($svr),$($evt.id),$($evt.TimeCreated),$SubjectUserName,$ObjectName,$AccessMask")

        Write-Host $svr
        Write-Host $evt.id,$evt.TimeCreated,$SubjectUserName,$ObjectName,$AccessMask

        }
    }
$out.ToString() | out-file -filepath C:\TEMP\4663Events.csv

To optimize performance, first measure it: the slowest part by far is Get-WinEvent. Now you can start looking for answers how to speed it up. What I know is that on a local computer Get-EventLog Security -InstanceId 4663 is 100 or 1000 times faster. Try testing it in your environment. If it's also slow, consider remote PS job execution so that Get-EventLog is executed locally on remote computers and results are sent back to yours. — woxxom
– woxxom, Commented Oct 1, 2016 at 10:47

vonPryz · Accepted Answer · 2016-10-02 06:28:25Z

2

Refactor the code so that the stringbuilder contents are flushed every now and then. This keeps its size more manageable. Like so,

$out = New-Object System.Text.StringBuilder
$out.AppendLine("ServerName,EventID,TimeCreated,UserName,File_or_Folder,AccessMask")
foreach($evt in $evts) {
    $xml = [xml]$evt.ToXml()
    ...
    $out.AppendLine("$($svr),$($evt.id),$($evt.TimeCreated),$SubjectUserName,$ObjectName,$AccessMask")
    # If the stringbuffer is large enough, flush its contents to disk
    # and start filling empty buffer again
    if($out.length -ge 100MB) {
        $out.ToString() | out-file -filepath C:\TEMP\4663Events.csv -append
        $out.Clear()
    }
}
# Remember to flush the buffer so that stuff that wasn't flushed in the
# foreach loop is saved as well
$out.ToString() | out-file -filepath C:\TEMP\4663Events.csv -append

Edit:

As the error is coming from Out-LineOutput, which is an internal cmdlet, it might be about the shell memory settings. You could try increasing the maximum memory per shell to, say 2 GB. Like so,

Set-Item .\MaxMemoryPerShellMB 2048

The MS Scripting Guys blog has a detailed article about configuring the limits

edited Oct 2, 2016 at 6:28

answered Oct 1, 2016 at 9:52

vonPryz

24.3k10 gold badges58 silver badges69 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Arbelac Over a year ago

thanks unfortunately I am still facing same issue So when running powershell code memory usage is growing and then I am getting "out of memory"

Arbelac Over a year ago

thanks again Finally How can we to fetch security event log based on specific AD Users instead of all of users?

vonPryz Over a year ago

That would be another a question worth its own. If the memory problem is solved, please check this as answered and open another for filtering log by user.

Collectives™ on Stack Overflow

Optimize PowerShell Performance and Memory Consumption

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related