Script Powershell para verificar logs de eventos do Windows para mensagens críticas

Question

Eu tenho um script powershell que verifica nos logs de eventos do Windows do aplicativo e do sistema erros. Está lá também para deixar verificar se há mensagens críticas? nos logs de eventos do Windows. Abaixo está um exemplo de script:

Set-Variable -Name EventAgeDays -Value 1     #we will take events for the latest 7 days
Set-Variable -Name CompArr -Value @("Server 1")   # replace it with your server names
Set-Variable -Name LogNames -Value @("Application", "System")  # Checking app and system logs
Set-Variable -Name EventTypes -Value @("Error")  # Loading only Errors and Warnings
Set-Variable -Name ExportFolder -Value "C:\EventLogs\"


$el_c = @()   #consolidated error log
$now=get-date
$startdate=$now.adddays(-$EventAgeDays)
$ExportFile=$ExportFolder + "el" + $now.ToString("yyyy-MM-dd---hh-mm-ss") + ".csv"  # we cannot use standard delimiteds like ":"

foreach($comp in $CompArr)
{
  foreach($log in $LogNames)
  {
    Write-Host Processing $comp\$log
    $el = get-eventlog -ComputerName $comp -log $log -After $startdate -EntryType $EventTypes
    $el_c += $el  #consolidating
  }
}
$el_sorted = $el_c | Sort-Object TimeGenerated    #sort by time
Write-Host Exporting to $ExportFile
$el_sorted|Select EntryType, TimeGenerated, Source, EventID, MachineName, Message | Export-CSV $ExportFile -NoTypeInfo  #EXPORT
Write-Host Done!

    

Answer 1

Set-Variable -Name EventAgeDays -Value 1     #we will take events for the latest 7 days
    Set-Variable -Name CompArr -Value @("localhost")   # replace it with your server names
    Set-Variable -Name LogNames -Value @("Application", "System")  # Checking app and system logs
    Set-Variable -Name EventTypes -Value @("1")  # Loading only Errors and Warnings
    Set-Variable -Name ExportFolder -Value "C:\EventLogs\"


    $el_c = @()   #consolidated error log
    $now=get-date
    $startdate=$now.adddays(-$EventAgeDays)
    $ExportFile=$ExportFolder + "el" + $now.ToString("yyyy-MM-dd---hh-mm-ss") + ".csv"  # we cannot use standard delimiteds like ":"

    foreach($comp in $CompArr)
    {
      foreach($log in $LogNames)
      {
        Write-Host Processing $comp\$log
        $el = get-winevent -ComputerName $comp -FilterHashtable @{logname="$log";level=$eventtypes;starttime=$startdate}
        $el_c += $el  #consolidating
      }
    }
    $el_sorted = $el_c | Sort-Object TimeGenerated    #sort by time
    #Write-Host Exporting to $ExportFile
    $el_sorted|Select LevelDisplayName, TimeCreated, ProviderName, ID, MachineName, Message 

Você pode alterar "eventtypes" para 1,2,3,4 (crítico, erro, aviso, informação)

    

Answer 2

Se você deseja filtrar eventos críticos, use get-winevent em vez de get-eventlog

algo como isto

Get-WinEvent -computername $comparr -FilterHashTable @{logname=$lognames; Level=1}

link link