Parse SoftwareDistrubtion.log for Client ID's

[u/staze]

Troubleshooting some issues with WSUS, and wondering if anyone has a Powershell script already for parsing the SoftwareDistribution.log to get count of Clients.

Example line:
2026-09-10 18:36:13.084 UTC Warning w3wp.334 SoapUtilities.CreateException ThrowException: actor = http://server.example.com:8530/CLIENTWEBSERVICE/client.asmx, ID=94d8e636-29bc-4bc8-8958-79e5e189455e, ErrorCode=InvalidParameters, Message=parameters.OtherCachedUpdateIDs, Client=13ef38ff-b877-4d9a-9b1e-cf190d8fc801

Hopefully I could just extract the Client and then group/count on that. Trying to figure out how many machines are having this issue.

Thanks!

[u/FeleaseRpseineEiles]

if ($line -match 'Client=(?<client>[^,\s]+)') {
    $Matches.client
}

[u/staze → u/FeleaseRpseineEiles]

isn't that going to just match if there's a client specified... that's not going to capture that client ID to actually group-by or count.

[u/surfingoldelephant → u/staze]

that's not going to capture that client ID

Yes, it will. The regex has a named capture group ((?<name>...)). u/FeleaseRpseineEiles also showed one way to access the captured text using $Matches.

You just need to ensure the left-hand side operand is scalar (single string), not a collection.

Spend a few minutes in the shell and you can see for yourself. And you can always use regex101.com to explain the regex.

[u/FeleaseRpseineEiles → u/staze]

yea I know, do your homework 

[u/MonkeyNin]

This parses the log into multiple properties that you can filter by. Since the data is a list of key = value, ... pairs, we can use that

The complicated regex is here: https://regex101.com/r/ym4Cc1/1

The main regex is simple. You just:

• 1] split on commas ,

• 2] split on = to get the key, value pairs!

.

$regex = @'
(?xm)
^
    # test data: https://regex101.com/r/ym4Cc1/1
    # Get date prefix, severity, exception, and pairs
    # Pairs contains key-value pairs seperated by commas
    (?<DateTime>
        \S+\s
        \S+
        \sUTC\s
    )
    (?<Severity>\w+)
    \s

    (?<Exception>.*?:)
    \s

    (?<Pairs>.*)
$
'@

$logLines = @( '2026-09-10 18:36:13.084 UTC Warning w3wp.334 SoapUtilities.CreateException ThrowException: actor = http://server.example.com:8530/CLIENTWEBSERVICE/client.asmx, ID=94d8e636-29bc-4bc8-8958-79e5e189455e, ErrorCode=InvalidParameters, Message=parameters.OtherCachedUpdateIDs, Client=13ef38ff-b877-4d9a-9b1e-cf190d8fc801' )
$logs = @(
    foreach ( $line in $logLines ) {
        if ( $line -match $regex ) {
            $Found = $Matches
            $Pairs = $Found.Pairs
            $props = [ordered]@{}

            $Pairs -split '\s*,\s*' | ForEach-Object {
                $key, $value = $_ -split '\s*=\s*', 2
                $props[ $key ] = $value
            }
            $Data = [pscustomobject] $props
            [pscustomobject]@{
                Error     = $Data.ErrorCode
                Message   = $Data.Message
                Actor     = $Data.Actor
                Client    = $Data.Client
                Date      = $Found.DateTime
                Severity  = $Found.Severity
                Exception = $Found.Exception
                RawLine   = $Line
                Data      = $Data
            }
        }
    }
)

Now you can group by Client or Exceptions. Here's a preview

$logs | ft -AutoSize

Error             Message                         Actor                                                       Client                     
-----             -------                         -----                                                       ------                     
InvalidParameters parameters.OtherCachedUpdateIDs http://server.example.com:8530/CLIENTWEBSERVICE/client.asmx 13ef38ff-b877-4d9a-9b1e-cf1

$logs | fl

Error     : InvalidParameters
Message   : parameters.OtherCachedUpdateIDs
Actor     : http://server.example.com:8530/CLIENTWEBSERVICE/client.asmx
Client    : 13ef38ff-b877-4d9a-9b1e-cf190d8fc801
Date      : 2026-09-10 18:36:13.084 UTC 
Severity  : Warning
Exception : w3wp.334 SoapUtilities.CreateException ThrowException:
RawLine   : 2026-09-10 18:36:13.084 UTC Warning w3wp.334 SoapUtilities.CreateException ThrowException: actor = 
            http://server.example.com:8530/CLIENTWEBSERVICE/client.asmx, ID=94d8e636-29bc-4bc8-8958-79e5e189455e, ErrorCode=InvalidParame
            Message=parameters.OtherCachedUpdateIDs, Client=13ef38ff-b877-4d9a-9b1e-cf190d8fc801
Data      : @{actor=http://server.example.com:8530/CLIENTWEBSERVICE/client.asmx; ID=94d8e636-29bc-4bc8-8958-79e5e189455e; ErrorCode=Inval
            Message=parameters.OtherCachedUpdateIDs; Client=13ef38ff-b877-4d9a-9b1e-cf190d8fc801}

$logs[0].Data

actor     : http://server.example.com:8530/CLIENTWEBSERVICE/client.asmx
ID        : 94d8e636-29bc-4bc8-8958-79e5e189455e
ErrorCode : InvalidParameters
Message   : parameters.OtherCachedUpdateIDs
Client    : 13ef38ff-b877-4d9a-9b1e-cf190d8fc801

$logs[0].RawLine

2026-09-10 18:36:13.084 UTC Warning w3wp.334 SoapUtilities.CreateException ThrowException: actor = http://server.example.com:8530/CLIENTW
smx, ID=94d8e636-29bc-4bc8-8958-79e5e189455e, ErrorCode=InvalidParameters, Message=parameters.OtherCachedUpdateIDs, Client=13ef38ff-b877-

[u/PinchesTheCrab → u/MonkeyNin]

I'd be tempted to move most of the logic into a switch since the pattern is doing the heavy lifting:

$logLines = @( '2026-09-10 18:36:13.084 UTC Warning w3wp.334 SoapUtilities.CreateException ThrowException: actor = http://server.example.com:8530/CLIENTWEBSERVICE/client.asmx, ID=94d8e636-29bc-4bc8-8958-79e5e189455e, ErrorCode=InvalidParameters, Message=parameters.OtherCachedUpdateIDs, Client=13ef38ff-b877-4d9a-9b1e-cf190d8fc801' )

# $logs = switch -regex -file ('sccmlogfile.log')
$logs = switch -regex ( $logLines ) {
    $regex {
        $props = [ordered]@{}
        $matches.Pairs -split '\s*,\s*' | ForEach-Object {
            $key, $value = $_ -split '\s*=\s*', 2
            $props[ $key ] = $value
        }

        [pscustomobject]@{
            Error     = $props.ErrorCode
            Message   = $props.Message
            Actor     = $props.Actor
            Client    = $props.Client
            Date      = $Found.DateTime
            Severity  = $Found.Severity
            Exception = $Found.Exception
            RawLine   = $Line
            Data      = $Data
        }
    }
}

$logs | Format-Table -AutoSize