Powershell小技巧之從文件獲取系統日志

2020-03-26 19:13:28

字體：大中小

來源：轉載

供稿：網友

有時你可能會需要分析系統文件將他們傳輸到硬盤，或你想直接從“evtx”讀取系統日志。

你可以這樣做：

復制代碼代碼如下:

	
	$path = "$env:windir/System32/Winevt/Logs/Setup.evtx"
	Get-WinEvent -Path $path

另附上一段獲取系統日志的代碼

復制代碼代碼如下:

	
	$StartTime = (get-date).Date + (new-timespan -Hours 6 -Minutes 35)
	$EndTime = (get-date).Date + (new-timespan -Hours 6 -Minutes 36)
	$global:TaskStart
	$Global:TaskComplete
	$Global:events
	$Global:event
	$Global:TimeSpent
	$Global:events = get-winevent -FilterHashtable @{logname = "Microsoft-Windows-TaskScheduler/Operational"; ID=107;StartTime=$StartTime;EndTime=$EndTime}
	Foreach($Global:event in $Global:events)
	{
	    cls
	    $StartLogs=get-winevent -FilterHashtable @{logname = "Microsoft-Windows-TaskScheduler/Operational";ID=100;StartTime=$StartTime}
	    $CompleteLogs=get-winevent -FilterHashtable @{logname = "Microsoft-Windows-TaskScheduler/Operational";id=102;StartTime=$StartTime}
	    $global:TaskStart=$StartLogs | where {$_.ActivityId -eq $Global:event.ActivityId}
	    $Global:TaskComplete=$CompleteLogs | where {$_.ActivityId -eq $Global:event.ActivityId}
	    $global:TimeSpent=($global:TaskComplete.timeCreated-$global:TaskStart.timeCreated).TotaLMinutes
	    if(($global:TaskStart -ne $NULL) -and ($Global:TaskComplete -ne $null) -and ($Global:TimeSpent -gt 1)){
	          
	        $Messagebody="Sync task started at:  "+$global:TaskStart.TimeCreated.DateTime+"`r`n"
	        $Messagebody=$Messagebody+"`r`nSync task completed at:  "+$global:TaskComplete.timeCreated.DateTime+"`r`n"
	        $Messagebody=$Messagebody+"`r`nTask lasted for "+("{0:N2}" -f ($Global:TimeSpent) )+" minutes"
	          
	        Send-MailMessage -From "CustomerLog@avepoint.com" -To "Zhijie.bai@avepoint.com","Infrastructure_cn@avepoint.com" -Subject "Customer Logs Sync Report:Success" -Body $Messagebody -SmtpServer "10.100.100.153" -Encoding UTF8
	    }
	    else{
	        $Messagebody="########################################################################`r`n"
	        $Messagebody=$Messagebody+"`r`nCustom logs Sync failed, please login 10.2.0.125 to check and sync again`r`n"
	        $Messagebody=$Messagebody+"`r`n########################################################################`r`n"
	        Send-MailMessage -From "CustomerLog@avepoint.com" -To "Zhijie.bai@avepoint.com","Infrastructure_cn@avepoint.com" -Subject "Customer Logs Sync Report:Failed" -Body $Messagebody -SmtpServer "10.100.100.153" -Encoding UTF8 -Priority High
	    }
	}