How many attachments per Incident?

One of my customers had issues with the Service Manager Exchange connector. There were situations, where updating incidents killed the whole Service Manager management server. During analysis it turned out that they had many incidents with lots of attachments – some with more than 100! Because this customer needs to track everything in the action log, every e-mail is attached as eml-file to the incident. This resulted in incidents having lots of attachments. Because the customer already has more than 30000 Incidents it was not that easy to find the incidents with the most attached file. Therefore I created a simple script to get that information out.

The script is based on the smlets PowerShell module. There are some other, maybe more efficient ways to collect that information, this is just a quick and dirty approach. Let’s take a look at the script.


First the module is loaded.

import-module smlets

Now I get a type projection that uses “Incident” as the seed class and contains the relationship “Work Item Has File Attachment”. And I also get the incident class itself.

$proj = Get-SCSMTypeProjection System.WorkItem.IncidentPortalProjection$

$class = get-scsmclass system.workitem.incident$

I now collect all incidents.

$incidents = get-scsmobject -class $class

For every incident I will now get the attached files by using the relationship to the attached files and count those.

$erroractionpreference = “SilentlyContinue”

foreach($incident in $incidents)


                $id = $

                $status = $incident.status.displayname

                $count = (Get-SCSMObjectProjection -Projection $proj -Filter “id -eq ‘$id'” | select -expand fileattachment).count

                if($count -eq $null){$count = “0”}

Incidents with less than 10 attachments are not displayes. If the count is between 10 and 19 the incident id, the count and the incident status are written to the console in yellow. If the count is greater than 20 the output is the same but in red. Just to play a little bit with the colors Smiley              

  #Option 1: Write to console

                if(($count -gt “10”) -and ($count -lt “20”)){Write-Host “Incident $id has $count attachments – Incident status is $status” -foregroundcolor yellow}

                if($count -ge “20”){Write-Host “Incident $id has $count attachments – Incident status is $status” -foregroundcolor red}

Instead of writing the information to the console, it can also written to a file to allow better analysis later.        

#Option 2: Write to file

                $file = “c:\temp\incidents.txt”

                #if($count -gt “10”){“$id,$count,$status” | out-file $file -append}



The result for Option 1 looks something like this:


The result for option 2 is a a file that looks something like this:


Feel free to optimize the script for your own needs …


About Marcel Zehner

Microsoft Azure MVP
This entry was posted in SCSM and tagged , , , , , . Bookmark the permalink.

1 Response to How many attachments per Incident?

  1. Pingback: How many attachments per Incident? - SysManBlog

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s