[转载代码] [PowerShell每日技巧]从全部事件日志中获取事件(20140415)

DAIC

Recently, a reader asked how to retrieve all events from all event logs from a local or remote system, and optionally save them to file.

Here is a potential solution:

# calculate start time (one hour before now)
$Start = (Get-Date) - (New-Timespan -Hours 1)
$Computername = $env:COMPUTERNAME

# Getting all event logs
Get-EventLog -AsString -ComputerName $Computername |
  ForEach-Object {
    # write status info
    Write-Progress -Activity "Checking Eventlogs on \\$ComputerName" -Status $_

    # get event entries and add the name of the log this came from
    Get-EventLog -LogName $_ -EntryType Error, Warning -After $Start -ComputerName $ComputerName -ErrorAction SilentlyContinue |
      Add-Member NoteProperty EventLog $_ -PassThru

  } |
  # sort descending
  Sort-Object -Property TimeGenerated -Descending |
  # select the properties for the report
  Select-Object EventLog, TimeGenerated, EntryType, Source, Message |
  # output into grid view window
  Out-GridView -Title "All Errors & Warnings from \\$Computername"
复制代码

At the top of this script, you can set the remote system you want to query, and the number of hours you want to go back.

Next, the script gets all log files available on that machine, and then uses a loop to get the errors and warnings from each log within the timeframe. To be able to know which event came from which log file, it also tags the events with a new property called "EventLog", using Add-Member.

The result is a report with all error and warning events within the last hour, shown in a grid view window. Replace "Out-GridView" with "Out-File" or "Export-Csv" to write the information to disk.

Note that remote access requires Administrator privileges. Remote access might require additional security settings. Note also that you will receive red error messages if you run this code as a non-Administrator (because some logs like "Security" require special access privileges).

http://powershell.com/cs/blogs/tips/archive/2014/04/15/getting-events-from-all-event-logs.aspx