标题: [转载代码] [PowerShell每日技巧]从全部事件日志中获取事件(20140415) [打印本页]
作者: DAIC 时间: 2014-4-17 13:21 标题: [PowerShell每日技巧]从全部事件日志中获取事件(20140415)
Recently, a reader asked how to retrieve all events from all event logs from a local or remote system, and optionally save them to file.
Here is a potential solution:- # calculate start time (one hour before now)
- $Start = (Get-Date) - (New-Timespan -Hours 1)
- $Computername = $env:COMPUTERNAME
-
- # Getting all event logs
- Get-EventLog -AsString -ComputerName $Computername |
- ForEach-Object {
- # write status info
- Write-Progress -Activity "Checking Eventlogs on \\$ComputerName" -Status $_
-
- # get event entries and add the name of the log this came from
- Get-EventLog -LogName $_ -EntryType Error, Warning -After $Start -ComputerName $ComputerName -ErrorAction SilentlyContinue |
- Add-Member NoteProperty EventLog $_ -PassThru
-
- } |
- # sort descending
- Sort-Object -Property TimeGenerated -Descending |
- # select the properties for the report
- Select-Object EventLog, TimeGenerated, EntryType, Source, Message |
- # output into grid view window
- Out-GridView -Title "All Errors & Warnings from \\$Computername"
At the top of this script, you can set the remote system you want to query, and the number of hours you want to go back.
Next, the script gets all log files available on that machine, and then uses a loop to get the errors and warnings from each log within the timeframe. To be able to know which event came from which log file, it also tags the events with a new property called "EventLog", using Add-Member.
The result is a report with all error and warning events within the last hour, shown in a grid view window. Replace "Out-GridView" with "Out-File" or "Export-Csv" to write the information to disk.
Note that remote access requires Administrator privileges. Remote access might require additional security settings. Note also that you will receive red error messages if you run this code as a non-Administrator (because some logs like "Security" require special access privileges).
http://powershell.com/cs/blogs/tips/archive/2014/04/15/getting-events-from-all-event-logs.aspx
| 欢迎光临 批处理之家 (http://www.bathome.net/) |
Powered by Discuz! 7.2 |