Merge pull request #12 from Thumbscrew/follow-wait

"-Wait" switch added for following the log

public/Get-PSFirewallLog.ps1

@@ -23,20 +23,24 @@ function Get-PSFirewallLog {
         [string]
         $LogProfile,
 
-        # Number of firewall events to retrieve. Defaults to 0 (All events).
+        # Number of firewall events to retrieve. Defaults to -1 (All events).
         [Parameter(Mandatory = $false)]
         [int]
-        $Tail = 0,
+        $Tail = -1,
 
         # ComputerName to retrieve log from
         [Parameter(Mandatory = $true, ParameterSetName = 'remote')]
         [string]
-        $ComputerName
+        $ComputerName,
+
+        # Follow the log
+        [Parameter(Mandatory = $false)]
+        [switch]
+        $Wait
     )
     
     begin {
         if($PSCmdlet.ParameterSetName -eq 'auto') {
-            # $Path = [Environment]::ExpandEnvironmentVariables((Get-ItemProperty -Path ("HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\{0}Profile\Logging" -f $LogProfile) -Name "LogFilePath").LogFilePath)
             $Path = Get-PSFirewallLogPath -LogProfile $LogProfile -Verbose:$VerbosePreference
         }
         elseif($PSCmdlet.ParameterSetName -eq 'remote') {
@@ -59,17 +63,6 @@ function Get-PSFirewallLog {
         }
 
         if(Test-Path $logPath) {
-            $log = Get-Content $logPath
-
-            if($log.Length -gt 0) {
-                # Remove header lines
-                $log = $log[5..($log.Length - 1)]
-
-                if($Tail -gt 0) {
-                    $startIndex = if($Tail -lt $log.Length) { $log.Length - $Tail } else { 0 }
-                    
-                    $log = $log[$startIndex..($log.Length - 1)]
-                }
 
             $members = @{
                 "Date" = 0
@@ -91,8 +84,24 @@ function Get-PSFirewallLog {
                 "Path" = 16
             }
 
-                $log | ForEach-Object {
+            $count = (Get-Content -Path $logPath).Count
+
+            # Check if outputting all events from the log and cut the first 5 lines that aren't events.
+            if(($Tail -lt 0) -or ($Tail -gt $count)) {
+                $Tail = $count - 5
+            }
+
+            Write-Verbose "Log has $count lines. Retrieving $Tail lines."
+
+            $c = "Get-Content -Path $logPath -Tail $Tail"
+
+            if($Wait) {
+                $c = "$c -Wait"
+            }
+
+            Invoke-Expression $c | ForEach-Object {
                 $line = $_
+
                 $split = $line -split ('\s')
 
                 $fwEvent = New-Object PSCustomObject
@@ -106,10 +115,6 @@ function Get-PSFirewallLog {
                 $fwEvent
             }
         }
-            else {
-                Write-Error "File $logPath has zero length."
-            }
-        }
         else {
             Write-Error "Failed to retrieve log at $logPath."
         }

public/Get-PSFirewallLogPath.ps1

@@ -61,7 +61,7 @@ function Get-PSFirewallLogPath {
             if($statusChanged) {
                 Write-Verbose ("Reverting status of $serviceName Service to {0}." -f $remoteRegistry.Status)
                 # Set-Service -Name $serviceName -ComputerName $ComputerName -Status $remoteRegistry.Status
-                # Need to use Invoke-Command as Set-Service won't stop a service that has dependancies
+                # Need to use Invoke-Command as Set-Service won't stop a service that has dependencies
                 Invoke-Command -ComputerName $ComputerName -ScriptBlock { Stop-Service -Name "RemoteRegistry" }
                 
                 # Verify that service has been restored to its original state.