diff --git a/Diagnostics/HealthChecker/Analyzer/Invoke-AnalyzerOsInformation.ps1 b/Diagnostics/HealthChecker/Analyzer/Invoke-AnalyzerOsInformation.ps1 index 2b3062f39..dc267fb8f 100644 --- a/Diagnostics/HealthChecker/Analyzer/Invoke-AnalyzerOsInformation.ps1 +++ b/Diagnostics/HealthChecker/Analyzer/Invoke-AnalyzerOsInformation.ps1 @@ -487,10 +487,13 @@ function Invoke-AnalyzerOsInformation { $days = 7 $testDate = (Get-Date).AddDays(-$days) foreach ($logType in $osInformation.EventLogInformation.Keys) { - if ($osInformation.EventLogInformation[$logType].LastLogEntry -gt $testDate) { + $logInfo = $osInformation.EventLogInformation[$logType] + # If the log isn't at the max limit, it is possible that they just cleared the logs or on a new server. This should be rare scenario. + if ($logInfo.LastLogEntry -gt $testDate -and + $logInfo.FileSize -ge $logInfo.MaxSize) { $params = $baseParams + @{ Name = "Event Log - $logType" - Details = "--ERROR-- Not enough logs to cover $days days. Last log entry is at $($osInformation.EventLogInformation[$logType].LastLogEntry)." + + Details = "--ERROR-- Not enough logs to cover $days days. Last log entry is at $($logInfo.LastLogEntry)." + " This could cause issues with determining Root Cause Analysis." DisplayWriteType = "Red" } diff --git a/Diagnostics/HealthChecker/DataCollection/ServerInformation/Get-EventLogInformation.ps1 b/Diagnostics/HealthChecker/DataCollection/ServerInformation/Get-EventLogInformation.ps1 index 8c83abbc7..54b0918f0 100644 --- a/Diagnostics/HealthChecker/DataCollection/ServerInformation/Get-EventLogInformation.ps1 +++ b/Diagnostics/HealthChecker/DataCollection/ServerInformation/Get-EventLogInformation.ps1 @@ -19,6 +19,7 @@ function Get-EventLogInformation { $results.Add($log, ([PSCustomObject]@{ LastLogEntry = $lastLogEntry.TimeCreated MaxSize = $listLog.MaximumSizeInBytes + FileSize = $listLog.FileSize LogMode = $listLog.LogMode.ToString() IsEnabled = $listLog.IsEnabled LogFilePath = $listLog.LogFilePath diff --git a/Diagnostics/HealthChecker/Tests/HealthChecker.E19.Scenarios.Tests.ps1 b/Diagnostics/HealthChecker/Tests/HealthChecker.E19.Scenarios.Tests.ps1 index c2c8e3c0c..bad4fafa8 100644 --- a/Diagnostics/HealthChecker/Tests/HealthChecker.E19.Scenarios.Tests.ps1 +++ b/Diagnostics/HealthChecker/Tests/HealthChecker.E19.Scenarios.Tests.ps1 @@ -107,8 +107,6 @@ Describe "Testing Health Checker by Mock Data Imports" { It "Event Log Size Test" { GetObject "Event Log - Application" | Should -BeLike "--ERROR-- Not enough logs to cover 7 days. Last log entry is at *. This could cause issues with determining Root Cause Analysis." - GetObject "Event Log - System" | - Should -BeLike "--ERROR-- Not enough logs to cover 7 days. Last log entry is at *. This could cause issues with determining Root Cause Analysis." } It "TCP Keep Alive Time" {