☰

Powershell 脚本用于检查 Windows 事件日志中的关键消息

tag-icon • tag-icon powershell
Powershell 脚本用于检查 Windows 事件日志中的关键消息

我有一个 powershell 脚本，用于检查应用程序和系统 Windows 事件日志中的错误。有没有办法让它检查 Windows 事件日志中的关键消息？以下是示例脚本：

Set-Variable -Name EventAgeDays -Value 1     #we will take events for the latest 7 days
Set-Variable -Name CompArr -Value @("Server 1")   # replace it with your server names
Set-Variable -Name LogNames -Value @("Application", "System")  # Checking app and system logs
Set-Variable -Name EventTypes -Value @("Error")  # Loading only Errors and Warnings
Set-Variable -Name ExportFolder -Value "C:\EventLogs\"


$el_c = @()   #consolidated error log
$now=get-date
$startdate=$now.adddays(-$EventAgeDays)
$ExportFile=$ExportFolder + "el" + $now.ToString("yyyy-MM-dd---hh-mm-ss") + ".csv"  # we cannot use standard delimiteds like ":"

foreach($comp in $CompArr)
{
  foreach($log in $LogNames)
  {
    Write-Host Processing $comp\$log
    $el = get-eventlog -ComputerName $comp -log $log -After $startdate -EntryType $EventTypes
    $el_c += $el  #consolidating
  }
}
$el_sorted = $el_c | Sort-Object TimeGenerated    #sort by time
Write-Host Exporting to $ExportFile
$el_sorted|Select EntryType, TimeGenerated, Source, EventID, MachineName, Message | Export-CSV $ExportFile -NoTypeInfo  #EXPORT
Write-Host Done!

答案1

Set-Variable -Name EventAgeDays -Value 1     #we will take events for the latest 7 days
    Set-Variable -Name CompArr -Value @("localhost")   # replace it with your server names
    Set-Variable -Name LogNames -Value @("Application", "System")  # Checking app and system logs
    Set-Variable -Name EventTypes -Value @("1")  # Loading only Errors and Warnings
    Set-Variable -Name ExportFolder -Value "C:\EventLogs\"


    $el_c = @()   #consolidated error log
    $now=get-date
    $startdate=$now.adddays(-$EventAgeDays)
    $ExportFile=$ExportFolder + "el" + $now.ToString("yyyy-MM-dd---hh-mm-ss") + ".csv"  # we cannot use standard delimiteds like ":"

    foreach($comp in $CompArr)
    {
      foreach($log in $LogNames)
      {
        Write-Host Processing $comp\$log
        $el = get-winevent -ComputerName $comp -FilterHashtable @{logname="$log";level=$eventtypes;starttime=$startdate}
        $el_c += $el  #consolidating
      }
    }
    $el_sorted = $el_c | Sort-Object TimeGenerated    #sort by time
    #Write-Host Exporting to $ExportFile
    $el_sorted|Select LevelDisplayName, TimeCreated, ProviderName, ID, MachineName, Message

您可以将“事件类型”更改为 1,2,3,4（严重、错误、警告、信息）

答案2

如果你想过滤关键事件，那么你需要get-winevent使用get-eventlog

类似这样的

Get-WinEvent -computername $comparr -FilterHashTable @{logname=$lognames; Level=1}

https://blogs.msdn.microsoft.com/powershell/2009/05/21/processing-event-logs-in-powershell/ https://technet.microsoft.com/library/hh849682.aspx

答案3

$CritSysMsgs = Get-WinEvent -LogName "System" | Where-Object -FilterScript {$_.LevelDisplayName -eq "Critical"} Write-Host "Critaical 消息：$CritSysMsgs"

相关内容