Tome's Land of IT

IT Notes from the Powertoe – Tome Tanasovski

Powershell and Scheduled Task Logs

There was a thread in the Powershell forum that posed a question of how to report on the status of scheduled tasks by using powershell on remote machines. My first thought was to use WMI:

$servername = "tome-mac"
$items = get-wmiobject -class "Win32_ScheduledJob" -namespace "root\CIMV2" -computername $servername
$items |select Command, Status

The above, however, only showed items scheduled via WMI or the AT command. I found a nice COM interface from this link that would let you look at the properties of scheduled tasks. I put together a quick script to look at the status of the tasks:

$servername = "tome-mac"
$schedule = new-object -com("Schedule.Service")
$tasks = $schedule.getfolder("\").gettasks(0)
$tasks |select name, lasttaskresult, lastruntime

This seemed to accomplish the goal, but Marco Shaw raised a very interesting point that had me go down the rabbit hole a little bit farther. His point was that it was possible to miss a failed task based on frequency of the task, and the possibility of failed runs from your script that checks the status.

I was reflecting on this point. In my environment I use a SQL agent server to manage all of our scheduled tasks for the company from a central location. We need it anyway for SSIS so it just makes sense to use it for all of our scripts too. It has very robust logging built in. I started thinking of little hacky ways to have your jobs within scheduled taks log their results to their own log files, but imagined how unmanageable this could become. Imagine creating a .bat for every task that would redirect the output to txt files that your script would monitor. A very cludgy way to defeat this problem.

I was wondering why Scheduled Tasks has no logging built in so I started looking to see if there are ways you can either do this or at least have a completion message sent to your app or system logs. Then I learned that there is a built-in log that I never knew existed:

You can view it in scheduled tasks under the advanced menu, but I found that the log location is located within HKLM\Software\Microsoft\SchedulingAgent\LogPath. The default is: %SystemRoot%\Tasks\SchedLgU.Txt

You could write a powershell script that parses this log file very easily. You could then have it output the last “Result:” listed for each command:

get-content schedlgu.txt |foreach {
    if ($_ -match '\"')
        $name = $_
    if ($_ -match "Result:\s([\s\S]*)")
        echo "" $name $matches[1]

The question is how to run it remotely. At this point you could use \\servername\c$ administrative share if you always know that the path is going to be the same or you could enable powershell remoting on each server and run it that way.

The only caveat with the above is that will not have your AT command history. Since win7/vista/2k8 now list your at commands within task scheduler I looked at the log there and found that it has even more information than in the above log, but the contents in the gui were not what was in schedlgu.txt. The contents of this log can be seen in event viewer under Microsfot\Windows\TaskScheduler\Operational. So I loaded that into powershell using get-winevent with level 2 to only get the errors. I also added a filter so that it would only return results from the past 24 hours.

$yesterday = (get-date) - (new-timespan -day 1)
$events = get-winevent -FilterHashtable @{logname = "Microsoft-Windows-TaskScheduler/Operational"; level = "2"; StartTime = $yesterday}
$events |foreach {

In the end the get-winevent method would be the best, but it will only work if you are using 2008/Vista/Win7.  If you are using Windows 2k3/XP your best bet is to read the log file directly and ensure that users do not use AT jobs for monitored tasks.  If you must monitor AT jobs as well you should probably use the Schedule.Service Com object, and just run the script frequently enough to pick up all failures if they occur.


2 responses to “Powershell and Scheduled Task Logs

  1. danehbear October 14, 2011 at 4:24 pm

    Just what I was looking for! Thanks.

  2. Kenneth Ambrose June 27, 2014 at 6:02 pm

    very helpful for me too, thanks!

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: