Powershell 日志文件输出未捕获所有数据

Powershell 日志文件输出未捕获所有数据,powershell,Powershell,对于Powershell v2 我有下面的代码(这只是我一直在研究的大众代码的一部分)。整个事情到处都是写主机,有人问我是否可以把它放到日志文件中。使用此链接,我已经按照步骤进行了操作,并尝试了大量其他内容,但我无法使所有输出正常工作: 很多东西并没有出现在日志文件中-日志文件中只是空白,但在屏幕上显示输出-即: 任何WMI调用输出-即 @(获取WmiObject-类Win32|U操作系统|选择标题, BuildNumber、CountryCode、CSD版本、CSName、InstallDa

对于Powershell v2

我有下面的代码(这只是我一直在研究的大众代码的一部分)。整个事情到处都是写主机,有人问我是否可以把它放到日志文件中。使用此链接,我已经按照步骤进行了操作,并尝试了大量其他内容,但我无法使所有输出正常工作:

很多东西并没有出现在日志文件中-日志文件中只是空白,但在屏幕上显示输出-即:

  • 任何WMI调用输出-即

    @(获取WmiObject-类Win32|U操作系统|选择标题, BuildNumber、CountryCode、CSD版本、CSName、InstallDate、, @{Name=“物理内存可用”表达式={{0:N1}GB -f($.FreePhysicalMemory/1mb)},@{Name=“分页文件中的可用空间”;表达式={{0:N1}GB”-f($.FreeSpaceInPagingFiles/1mb)}, @{Name=“空闲虚拟内存”表达式={{0:N1}GB -f($\免费虚拟内存/1mb)}}{格式列表)

  • 刚刚运行的任何命令:ie
    net localgroup administrators

  • 还有很多,但似乎大部分都是WMI调用

    以下是代码中存在问题的部分:

    网络部分:

    $forward = nslookup $computername
    
    
    $reverse = [System.Net.Dns]::GetHostByName($computername) | select -Expa AddressList | select -Expa ipaddresstostring | % { nslookup $_ }
    
    LogWrite "Doing forward lookup: "
    $forward
    LogWrite `r`n
    LogWrite "Doing reverse lookup: "
    $reverse
    
    #$computername = gc env:computername
    #$serverName = SV180515
    
    $NicConfig = Get-WmiObject -Class Win32_NetworkAdapterConfiguration -ComputerName $computername
    $myCol = @()
    ForEach ($Nic in $NicConfig)
    {
        If ($Nic.IPAddress -ne $null)
        {
            $myObj = "" | Select-Object Description, DHCPEnabled, IPAddress, IPSubnet, DefaultIPGateway, DNSServers, WINSServers, NICModel, SpeedDuplex
            $myObj.Description = $Nic.Description
            $myObj.DHCPEnabled = $Nic.DHCPEnabled
            $myObj.IPAddress = $Nic.IPAddress
            $myObj.IPSubnet = $Nic.IPSubnet
            $myObj.DefaultIPGateway = $Nic.DefaultIPGateway
            $myObj.DNSServers = $Nic.DNSServerSearchOrder
            $myObj.WINSServers = $Nic.WINSPrimaryServer,$Nic.WINSSecondaryServer
            $registry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $computername)
            $baseKey = $registry.OpenSubKey("SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}")
            $subKeyNames = $baseKey.GetSubKeyNames()
            ForEach ($subKeyName in $subKeyNames)
            {
                $subKey = $baseKey.OpenSubKey("$subKeyName")
                $ID = $subKey.GetValue("NetCfgInstanceId")
                If ($ID -eq $Nic.SettingId)
                {
                    $componentID = $subKey.GetValue("ComponentID")
                    If ($componentID -match "ven_14e4")
                    {
                        $myObj.NICModel = "Broadcom"
                        $requestedMediaType = $subKey.GetValue("RequestedMediaType")
                        $enum = $subKey.OpenSubKey("Ndi\Params\RequestedMediaType\Enum")
                        $myObj.SpeedDuplex = $enum.GetValue("$requestedMediaType")
                    }
                    ElseIf ($componentID -match "ven_8086")
                    {
                        $myObj.NICModel = "Intel"
                        $SD = $subKey.GetValue("*SpeedDuplex")
                        $enum = $subKey.OpenSubKey("Ndi\Params\*SpeedDuplex\Enum")
                        $myObj.SpeedDuplex = $enum.GetValue("$SD")
                    }
                    ElseIf ($componentID -match "b06bdrv")
                    {
                        $myObj.NICModel = "Broadcom"
                        $SD = $subKey.GetValue("*SpeedDuplex")
                        $enum = $subKey.OpenSubKey("BRCMndi\Params\*SpeedDuplex\Enum")
                        $myObj.SpeedDuplex = $enum.GetValue("$SD")
                    }
                    Else
                    {
                        $myObj.NICModel = "unknown"
                        $myObj.SpeedDuplex = "unknown"
                    }
                }
            }
            $myCol += $myObj
        }
    }
    $myCol
    
    WMI位:

    #Check for local groups on server
    net localgroup administrators
    
    #checking event log for errors
    LogWrite "Checking System Event log for errors"
    Get-Eventlog system -newest 2000 | where {$_.entryType -match "Error"} | Format-Table TimeWritten, EventID, Message -auto
    
    LogWrite `
    
    
    LogWrite "Checking Application Event log for errors"
    Get-Eventlog application -newest 2000 | where {$_.entryType -match "Error"} | Format-Table TimeWritten, EventID, Message -auto
    
    Get-WMIObject Win32_LogicalDisk | Select SystemName,DriveType,DeviceID,VolumeName,@{Name=”size(GB)”;Expression={“{0:N1}” -f($_.size/1gb)}},@{Name=”freespace(GB)”;Expression={“{0:N1}” -f($_.freespace/1gb)}},@{Name=”Percentage(%) Free”;Expression={“{0:0}%” -f($_.freespace*100/$_.size)}}| Format-Table -AutoSize
    
    $pagefilesize = Get-WmiObject win32_pagefile | ForEach-Object {$_.FileSize/1gb}
    
    #LogWrite "Page File is set to"$pagefilesize"GB"
    
    #check pagefile is systemed managed - if it is set to 0 then it is system managed
    $PageFileSystem = Get-WmiObject Win32_PageFileSetting
    
    if ($PageFileSystem.MaximumSize -eq "0")
    {
    LogWrite "Page File is System Managed and set to"$pagefilesize"GB"
    }
    else
    {
    LogWrite "*********ERROR - Page File is not System Mangaged*********"
    }
    

    运行powershell.exe-file script.ps1*>c:\log.txt这将在日志文件中写入所有输出和错误

    或者,您可以使用开始转录本:

    start-transcript -path c:\temp\mylog.txt
    .\myscript.ps1
    stop-transcript
    

    您是否考虑过在函数中收集脚本?然后可以使用
    Out File-Append
    运行脚本中的函数来记录它。将
    写入主机
    替换为
    写入输出
    ,因为写入主机是交互式cmdlet。然后在run命令中提供logpath。以下是一个示例:

    无标题2.ps1

    param($logpath)
    
    function test {
    $service = Get-Service | where {$_.status -eq "Running" } 
    $service | ft name, status -auto
    Write-output "hey"
    ping 10.0.0.1
    
    net localgroup
    }
    
    if($logpath) {
        #Run functions in script
        test | Out-File -Append $logpath
    } else {
        #Run functions in script
        test
    }
    
    然后我在cmd/bat中使用以下命令运行它:

    powershell.exe -noprofile -file Untitled2.ps1 -logpath "c:\users\graimer\desktop\testlog.txt"
    
    或者在powershell中:

    .\Untitled2.ps1 -logpath "c:\users\graimer\desktop\testlog.txt"
    

    另一个答案可能是在执行脚本后捕获缓冲区内容。请看这里:

    *>
    仅适用于PowerShell v3,它仍然不会捕获写入主机/控制台.WriteLine输出。但是如果你在V3上,这几乎是我所知道的最好的解决方案。这部分奏效了…我现在得到了所有的信息,但是格式真的很糟糕。它将每个输出彼此相邻,而不是放在新的行上…即“此脚本正在Server2047计算机上运行说明:TESING_SERVER,JAK R05Server属性:”-这应该按行拆分-一行用于计算机描述,另一行用于名称等。目前,这将所有内容放在一行中,彼此相邻。抱歉-忘记提及-此脚本适用于Powershell v2。我将更新描述