Analyse Windows event log entries using PowerShell and regular expressions

Question

I'm currently working on a PowerShell script to analyse VPN traffic by reading the event log of our VPN server.

I'm using WMI to retrieve the relevant event entries and a regular expression to extract information like user name, traffic etc. The event message obviously does contain line breaks which I don't seem to be able to match via my expression.

Example:

The user MYDOMAIN\CHARLY connected on port VPN3-18 on 04.07.2009 at 23:19 and disconnected on
05.07.2009 at 00:03.  The user was active for 43 minutes 55 seconds.  886949 bytes
were sent and 195113 bytes were received. The
reason for disconnecting was user request.

This is my expression:

The user (?<user>\w*\\\w*) connected on port (?<port>\w*-\w*) on (?<connectdate>\w*.\w*.\w*) at (?<connecttime>\w*:\w*) and disconnected on'n(?<disconnectdate>\w*.\w*.\w*) at (?<disconnecttime>\w*:\w*).  The user was active for (?<activeminutes>\w*) minutes (?<activeseconds>\w*) seconds.  (?<bytessent>\w*) bytes'nwere sent and (?<bytesreceived>\w*) bytes were received. The'nreason for disconnecting was user request.

Right now I don't know what else to try so any help is highly appreciated.

Answer 1

Line-breaks match against \s (white-space). Try testing bits of your regex and building it up.

For help with regular expressions, try

get-help about_regular_expression

Answer 2

Note, to get maximum control of regular expressions instantiate a [regex] (PSH shortcut for System.Text.RegularExpressions.Regex). This allows you access to RegexOptions enumeration to provide more control that -match does.

E.g.

$r1 = [regex]"Foo\s*bar"
$r2 = New-Object "System.Text.RegularExpressions.Regex" "Foo\s*bar",[System.Text.RegularExpressions.RegexOptions]::IgnorePatternWhitespace

(In the last case, that option allows literal whitespace to be ignored (including newlines), useful when building complex expressions.)

This page gives details of the supported character classes: \s matches:

Matches any white-space character. Equivalent to the escape sequences and Unicode general categories [\f\n\r\t\v\x85\p{Z}].