Powershell事件日志报告

我正在编写一个PS脚本来收集某些事件ID，并每隔一个小时左右将它们吐回。我这样做是因为我想把它发到电子邮件里，以便阅读

我现在的问题是脚本将运行到某个点并挂起。如果我删除日期过滤器，它运行良好。只要我通过变量或硬编码重新添加它们，它就会再次挂起。然而，我需要日期过滤器，因为否则，当我寻找每小时的数据块时，我会得到所有信息

寻找建议，因为我想使用一次性或修改变量！我也希望在其他方面的报道中使用衍生产品

$filedate = (get-date).ToString("MM_dd_yy-hh_mm")
$filename = "bad_logins_DC01 " + $filedate + "_log.txt"
$after = (get-date).addhours(-1)
$before = (get-date)
$eventlog = Get-EventLog -ComputerName DC01 -LogName Security -After $after -Before $before

$eventlog | ?{$_.EventID -eq 4771 -or $_.EventID -eq 4776 } | Select @{Name="Event ID";Expression={$_.InstanceID}},@{Name="UserName";Expression={$_.ReplacementStrings[0]}},@{Name="Failure Code";Expression={$_.ReplacementStrings[4]}},@{Name="Host";Expression={$_.ReplacementStrings[6]}},@{Name="Port";Expression={$_.ReplacementStrings[7]}}, @{Name="Time";Expression={$_.TimeGenerated}} | ft | Out-File $filename -append -noclobber

$to = itsupport@ourdomain.com
$from = itsupport@ourdomain.com
$subject = $filename 
$smtp = exchange.ourdomain.com
$contents = cat $filename
$body = $contents

Send-MailMessage -SmtpServer $smtp -To $to -From $from -Subject $subject -Body $body -Attachments $filename

明白了

非常感谢MadTechnicial在获取WinEvent而不是获取事件日志方面提供的帮助

$query_sec = @"
<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*`
[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and `
TimeCreated[timediff(@SystemTime) &lt;= 7200000] and `
(EventID=4771 or EventID=4776)]]</Select>
  </Query>
</QueryList>
"@

$time = (Get-Date).ToString("dd-MM_hh-mm")
$to = "itsupport@mydomain.com"
$from = "me@mydomain.com"
$smtpServer = "mxserver.mydomain.com"

Try
 {
 $domain_controller = "DC01","C02","DC03"
      ForEach ($dc in $domain_controller) 
              {

              $Events = Get-WinEvent -ComputerName $dc -FilterXml $query_sec -ErrorAction Stop

         ForEach ($event in $Events) 
                  {

                     $eventXML = [xml]$Event.ToXml()

                     For ($i=0; $i -lt $eventXML.Event.EventData.Data.Count; $i++) 
                              {
                              Add-Member -InputObject $Event -MemberType NoteProperty -Force `
                                         -Name $eventXML.Event.EventData.Data[$i].Name `
                                         -Value $eventXML.Event.EventData.Data[$i].'#text'
                                               }
                                         }



    $filename = "C:\temp\"+$dc+"_failed_logins_"+$time+".txt"


    $Events | Select-Object @{Name="UID";Expression={$_.TargetUserName}},`
                ServiceName,`
                @{Name="Error";Expression={$_.Status}},`
                @{Name="IP";Expression={$_.IpAddress}},`
                @{Name="Port";Expression={$_.IpPort}},`
                @{Name="Event ID";Expression={$_.ID}},`
                @{Name="Source";Expression={$_.MachineName}}`
                | FT `
                | Out-File $filename 


    $subject = "Bad Logins on " + $dc + " at " + $time
    $body = Get-Content -Path $filename -Raw


    Send-MailMessage -To $to -Subject $subject -From $from -SmtpServer $smtpServer -Body $body
        }
    }

Catch [Exception]
    {
    Write-Output " "
    Write-Output "$dc has no relevant event logs!"
    }

---

您是否可以使用Get WinEvent替代？该cmdlet的-FilterXML选项非常出色。我切换到WinEvent，这真的很有帮助！这太壮观了！我喜欢看到有人问一个问题，得到一个建议，并且能够提供一个实用的答案。感谢您发布您的答案，请务必明天回来将其标记为已接受！我很高兴我能给你一个轻推，让所有东西都咔嗒咔嗒响。