Powershell小技巧之从文件获取系统日志_PowerShell

Powershell小技巧之从文件获取系统日志

2020-06-28 10:23PowerShell教程网 PowerShell

事件日志对于系统管理员的重要性自不待言，而基于图形界面的事件查看器毫无疑问是我们进行日志管理的首选工具，但绝不是最快捷的工具。其实，PowerShell提供了一种更简单的方式，利用它我们不仅可访问当前系统的事件日志，

有时你可能会需要分析系统文件将他们传输到硬盘，或你想直接从“evtx”读取系统日志。

你可以这样做：

复制代码代码如下:

	
	$path = "$env:windir\System32\Winevt\Logs\Setup.evtx"

	Get-WinEvent -Path $path

另附上一段获取系统日志的代码

复制代码代码如下:

	
	$StartTime = (get-date).Date + (new-timespan -Hours 6 -Minutes 35)

	$EndTime = (get-date).Date + (new-timespan -Hours 6 -Minutes 36)

	$global:TaskStart

	$Global:TaskComplete

	$Global:events

	$Global:event

	$Global:TimeSpent

	$Global:events = get-winevent -FilterHashtable @{logname = "Microsoft-Windows-TaskScheduler/Operational"; ID=107;StartTime=$StartTime;EndTime=$EndTime}

	Foreach($Global:event in $Global:events)

	{

	    cls

	    $StartLogs=get-winevent -FilterHashtable @{logname = "Microsoft-Windows-TaskScheduler/Operational";ID=100;StartTime=$StartTime}

	    $CompleteLogs=get-winevent -FilterHashtable @{logname = "Microsoft-Windows-TaskScheduler/Operational";id=102;StartTime=$StartTime}

	    $global:TaskStart=$StartLogs | where {$_.ActivityId -eq $Global:event.ActivityId}

	    $Global:TaskComplete=$CompleteLogs | where {$_.ActivityId -eq $Global:event.ActivityId}

	    $global:TimeSpent=($global:TaskComplete.timeCreated-$global:TaskStart.timeCreated).TotaLMinutes

	    if(($global:TaskStart -ne $NULL) -and ($Global:TaskComplete -ne $null) -and ($Global:TimeSpent -gt 1)){

	        $Messagebody="Sync task started at:  "+$global:TaskStart.TimeCreated.DateTime+"`r`n"

	        $Messagebody=$Messagebody+"`r`nSync task completed at:  "+$global:TaskComplete.timeCreated.DateTime+"`r`n"

	        $Messagebody=$Messagebody+"`r`nTask lasted for "+("{0:N2}" -f ($Global:TimeSpent) )+" minutes"

	        Send-MailMessage -From "CustomerLog@avepoint.com" -To "Zhijie.bai@avepoint.com","Infrastructure_cn@avepoint.com" -Subject "Customer Logs Sync Report:Success" -Body $Messagebody -SmtpServer "10.100.100.153" -Encoding UTF8

	    }

	    else{

	        $Messagebody="########################################################################`r`n"

	        $Messagebody=$Messagebody+"`r`nCustom logs Sync failed, please login 10.2.0.125 to check and sync again`r`n"

	        $Messagebody=$Messagebody+"`r`n########################################################################`r`n"

	        Send-MailMessage -From "CustomerLog@avepoint.com" -To "Zhijie.bai@avepoint.com","Infrastructure_cn@avepoint.com" -Subject "Customer Logs Sync Report:Failed" -Body $Messagebody -SmtpServer "10.100.100.153" -Encoding UTF8 -Priority High

	    }

	}