Event Viewer PowerShell Fun

June 3, 2009 Alan PowerShell, 5

Around a month ago I was trying to convince a friend to start using Powershell, “I’m too busy to start learning anything new” he said.

He was writing a C# application to connect to a whole bunch of server he had, pull out the event viewer information for errors and store them in a central location which the support team could check every week.

My response to him was that he should use such a project to try and start learning powershell, My exact words were “Its a short script, probably even a one-liner !”.

I never did hear back from him (I guess he is still writing the C# app) but again this question was asked by another friend recently so seeing as I had a spare 5 minutes I thought I would share with you the results of this one-liner:

Get-content c:\temp\servers.txt | foreach { get-wmiobject win32_ntlogevent -filter "type=’error’" -computer $_ | Select ComputerName, EventCode, EventIdentifier, EventType, Logfile, Message, RecordNumber, SourceName, @{N="TimeGenerated";E={$_.ConvertToDateTime($_.TimeGenerated)}}, @{N="TimeWritten";E={$_.ConvertToDateTime($_.TimeWritten)}}, Type, User | export-csv -NoTypeInformation "c:\temp\$_-$((get-date -f MM_dd_yy)).csv"}

Or broken down into a readable format:

Get-content c:\temp\servers.txt |`
foreach {get-wmiobject win32_ntlogevent -filter "type=’error’" -computer$_ |`
   Select ComputerName,EventCode,EventIdentifier,`
   EventType,Logfile,Message,RecordNumber,SourceName,`
    @{N="TimeGenerated";E={$_.ConvertToDateTime($_.TimeGenerated)}},`
    @{N="TimeWritten";E={$_.ConvertToDateTime($_.TimeWritten)}}, `
    Type, User |`
    export-csv -NoTypeInformation "c:\temp\$_-$((get-date -f MM_dd_yy)).csv"}

You can obviously choose your output and easily create a htm file rather than a csv:

Get-content c:\temp\servers.txt |`
foreach {get-wmiobject win32_ntlogevent -filter "type=’error’" -computer$_ |`
   Select ComputerName,EventCode,EventIdentifier,`
   EventType,Logfile,Message,RecordNumber,SourceName,`
    @{N="TimeGenerated";E={$_.ConvertToDateTime($_.TimeGenerated)}},`
    @{N="TimeWritten";E={$_.ConvertToDateTime($_.TimeWritten)}},`
   Type,User |`
   ConvertTo-html "c:\temp\$_-$((get-date -f MM_dd_yy)).htm"}

Much faster than righting a C# app ! – My Lesson for today is….

LEARN POWERSHELL IT SAVES YOU TIME !

PowerShell

Unofficial Online VMware User Group Exchange 2007 PowerShell Audit