I discovered an extremely helpful post, as usual, from Shay Levy, which pointed me in the right direction.
I changed my script to use .NET instead of WMI for event logs so I decided to continue using this method for the white space as well.
The basic script to collect the white space sizes from the event log using .NET is as follows:
$now = Get-Date
$colMailboxStores = Get-MailboxDatabase -Server SERVER -Status | Sort-Object Name
$spaceLog=[System.Diagnostics.EventLog]::GetEventLogs('SERVER') | where {($_.LogDisplayName -eq "Application")}
foreach ($objMailboxStore in $colMailboxStores)
{
Write-Host "..Getting database white space for" $objMailboxStore.Name
$store = @{Name="store";Expression={$_.ReplacementStrings[1]}}
$freeMB = @{Name="freeMB";Expression={[int]$_.ReplacementStrings[0]}}
$whiteSpace = @()
$whiteSpace += $spaceLog.entries | where {($_.TimeWritten -ge $now.AddDays(-1))} | where {($_.EventID -eq "1221")} | where {($_.ReplacementStrings[1] -match $objMailboxStore.Name)} | select $store,$freeMB -last 1
$whiteSpace.freeMB
}
It was was painful during testing to wait for the above script to complete and I really felt that the speed of this process should be increased, so instead I came up with the following solution:
$now = Get-Date
$spaceLog=[System.Diagnostics.EventLog]::GetEventLogs('SERVER') | where {($_.LogDisplayName -eq "Application")}
$db = @{Name="database";Expression={$_.ReplacementStrings[1]}}
$freeMB = @{Name="MB";Expression={[int]$_.ReplacementStrings[0]}}
$whiteSpace = $spaceLog.entries | where {($_.TimeWritten -ge $now.AddDays(-1))} | where {($_.EventID -eq "1221")} | select $db,$freeMB
($whitespace | where {$_.database -match $objMailboxStore.Name} | select -last 1).mb
The code above will collect all of the Event ID 1221’s for the last day and store them in a variable with the customised place holders from the expressions.
This happens once per server only and any subsequent searches can be performed against the variable instead.
The select statement at the end, also selects the last item in the list to ensure that you also look at the latest event for each database. This literally reduces the runtime of the script by a factor equal to the amount of databases on your server.
I will be posting an update to the Exchange 2007 audit script soon, so stay tuned.
