powershellresolve

Change DNS Lookup in existing script


I have an script which parses Log files and it matches IP, Message Number, Date and DNS Name. But since i Resolve DNS with every Line i parse it takes really long. After i got all matches i count them together to know which ip sends how many messages. The existing script is:

$global:result = Get-Content $path | ForEach-Object {
    if($_ -match '(\d{2}\.\d{2}\.\d{4} \d{2}:\d{2}:\d{2}).*\(((?:\d{1,3}\.){3}\d{1,3})\) disconnected\.?\s+(\d+) message\[s\]'){
        try {
            #$dns = [System.Net.Dns]::GetHostEntry($matches[2]).HostName
        }
        catch { 
            #$dns = 'Not available' 
        }
        [PsCustomObject]@{
            IP       = $matches[2]
            Messages = [int]$matches[3]
            #DNSName  = $dns
            Date     = [datetime]::ParseExact($matches[1], 'dd.MM.yyyy HH:mm:ss', $null)
        }}

        $i++
    if($i % 1000 -eq 0){
        Write-Progress -activity "Searching for matches" -status "Scanned: $i of $($length)" -percentComplete (($i / $length)  * 100)
    
 }}

 Write-Progress -activity "Searching for matches" -status "Scanned: $i of $($length)" -percentComplete (($i / $length)  * 100)

 #Messages Counted
 $global:cumulative = $result | Group-Object -Property IP | ForEach-Object {
    [PsCustomObject]@{
        IP = $_.Name
        Messages = ($_.Group | Measure-Object -Property Messages -Sum).Sum
        #DNSName = $_.Group[0].DNSName
        Date    = ($_.Group | Sort-Object Date)[-1].Date
    }
}

How can i do the DNS Resolve after i sorted all different IPs i got in the Log Files and still display it as one of the Results in $cumulative?


Solution

  • Just move the code to where you define the custom objects for $global:cumulative:

    $global:result = Get-Content $path | ForEach-Object {
        if($_ -match '(\d{2}\.\d{2}\.\d{4} \d{2}:\d{2}:\d{2}).*\(((?:\d{1,3}\.){3}\d{1,3})\) disconnected\.?\s+(\d+) message\[s\]'){
            [PsCustomObject]@{
                IP       = $matches[2]
                Messages = [int]$matches[3]
                Date     = [datetime]::ParseExact($matches[1], 'dd.MM.yyyy HH:mm:ss', $null)
            }}
    
            $i++
        if($i % 1000 -eq 0){
            Write-Progress -activity "Searching for matches" -status "Scanned: $i of $($length)" -percentComplete (($i / $length)  * 100)
        
     }}
    
     Write-Progress -activity "Searching for matches" -status "Scanned: $i of $($length)" -percentComplete (($i / $length)  * 100)
    
     #Messages Counted
     $global:cumulative = $result | Group-Object -Property IP | ForEach-Object {
    
        try {
            $dns = [System.Net.Dns]::GetHostEntry($_.Name).HostName
        }
        catch { 
            $dns = 'Not available' 
        }
    
        [PsCustomObject]@{
            IP = $_.Name
            Messages = ($_.Group | Measure-Object -Property Messages -Sum).Sum
            DNSName = $dns
            Date    = ($_.Group | Sort-Object Date)[-1].Date
        }
    }