Powershell 2: If [piped string] does not contain X, drop. If it does, pipe out.

[Garacesh]

I tried using Data in an earlier iteration of my code. It didn't work.

Just retried it now, and it worked. Though I'm positive I used it in the HashTable.. I figured it was down to me using PSv2 not PSv3.. Or maybe I just did something wrong..

Either way, thank you very much - that's considerably sped it up!

[pcstru]

I'd like to parse the users account name out of the message for which I've tried

 

$acc=select-string -InputObject ($t) -pattern "Account Name:[\t]*[A-Za-z0-9]*\.[A-Za-z0-9]*"

 

This works on the final file but not the message. I'm obviously assuming something that's not right - anyone know what?

[Garacesh]

'Works on the final file, but not the message'?

Do you mean if you attach it to Get-WinEvent it doesn't work, but if you 'Get-Content | $Logfile | $acc = [...]' it works?

[pcstru]

Assuming I named the fulllogfile c:\temp.txt

 

select-string c:\temp.txt -pattern "Account Name:[\t]*[A-Za-z0-9]*\.[A-Za-z0-9]*"

 

Finds the account names (all ours have a dot in them).

 

Whereas in the foreach loop

 

$acc=select-string -InputObject $event.message -pattern "Account Name:[\t]*[A-Za-z0-9]*\.[A-Za-z0-9]*"

 

Does not work - it spits the whole message back. I suspect it's to do with line breaks and out-file is applying some default translation to the fulllog string whereas the string itself is just one 'line'.

[Garacesh]

Well, with -replace "(?s) string" makes it work across multiple lines. Perhaps something similar is needed?

What's the significance of [\t]? I'm assuming [A-Za-z0-9] means 'only characters A to Z, a to z and 0 to 9 are allowed'

[pcstru]

Well, with -replace "(?s) string" makes it work across multiple lines. Perhaps something similar is needed?

What's the significance of [\t]? I'm assuming [A-Za-z0-9] means 'only characters A to Z, a to z and 0 to 9 are allowed'

 

\t is a tab, so one or more tabs followed by a typical logon name firstname.surname.

[Garacesh]

I thought `t was tab?

[pcstru]

In a regular expression, I don't think so. I've managed to just about do what I want :

$fqdn="."
$me=100

$count=0
$fulllog=""
$ObjArr = @()

# Query eventlog of $fqdn, return $me instances of Microsoft Windows Security Auditing logs with ID of 4624 (Logon). Create array.
foreach ($event in Get-WinEvent -ComputerName "$fqdn" -FilterHashtable @{ProviderName="Microsoft-Windows-Security-Auditing"; ID="4624"; Data="C:\Windows\System32\winlogon.exe" } -MaxEvents $me ) {

  $Obj = New-Object System.object
  
  $c = $event.message | where { $_ -match "Account Name:[\t]*(?[A-Za-z0-9]*\.[A-Za-z0-9]*)" } | foreach { $Obj | Add-Member -Type NoteProperty –name UserName -value $matches['username'] }

  $Obj | Add-Member –Type NoteProperty –name Time -value $($event.timecreated)     
  
  $ObjArr += $Obj    
  $count++   
  
}
Write-Host "$count events logged"
$ObjArr | Export-CSV c:\temp\temp.csv

 

But I obviously didn't figure out why select-string didn't work!

[Garacesh]

Hmm. Well I honestly have no clue..

Solving it without knowing the problem.. I think that would frustrate me more than not solving it at all!

 

On a nicer note:

		$newtime = [regex]::split($event.timecreated, "/")
	$newtime = ($newtime[1] + "/" + $newtime[0] + "/" + $newtime[2])

Date's no longer in American

 

So, that's problems 2 (date-time) and 3 (overparsing) sorted!

Since I can't actually fix the fact that Get-WinEvent doesn't work properly in Powershell 3, I'm not sure what else I could do. I tried stripping out more of the information I don't need (since, realistically, I only need date, time and username), but then it just looks too 'alien' and not like an event log.. So I might just leave it as-is. I need a new project now.. What else do I do repeatedly..?

Edited September 20, 2013 by Garacesh

[Garacesh]

Whoops! Sorry @fiza - here you go!

 

[color="#008000"]# Set name of remote machine to query, create fqdn reference.[/color]
[color="#4B0082"]$cn[/color] [color="#FF0000"]=[/color] [color="#008080"]read-host[/color] [color="#800000"]"ComputerName?"[/color]
[color="#4B0082"]$fqdn[/color] [color="#FF0000"]=[/color] ([color="#4B0082"]$cn[/color] [color="#FF0000"]+[/color] [color="#800000"]".domain.local"[/color])
[color="#008000"]# Set amount of logs to query. If returned null, sets to 4.[/color]
[color="#4B0082"]$me[/color] [color="#FF0000"]=[/color] [color="#008080"]Read-Host[/color] [color="#800000"]"MaxEvents? (Default: 4)"[/color]
[color="#0000FF"]if[/color] ([color="#4B0082"]$me[/color] [color="#FF0000"]-eq[/color] [color="#800000"]""[/color]) {([color="#4B0082"]$me[/color] [color="#FF0000"]=[/color] 4)}
[color="#008000"]# Set log file name using $cn[/color]
[color="#4B0082"]$logFile[/color] [color="#FF0000"]=[/color] [color="#800000"]"M:\"[/color] [color="#FF0000"]+[/color] [color="#4B0082"]$cn[/color] [color="#FF0000"]+[/color] [color="#800000"]"Log.txt"[/color]

[color="#008000"]# Query eventlog of $fqdn, return $me instances of Microsoft Windows Security Auditing logs with ID of 4624 (Logon) containing the phrase C:\...\winlogon.exe[/color]
[color="#0000FF"]foreach[/color] ([color="#4B0082"]$event[/color] [color="#0000FF"]in[/color] [color="#008080"]Get-WinEvent -ComputerName[/color] [color="#800000"]"$fqdn"[/color] [color="#008080"]-FilterHashtable[/color] @{ProviderName[color="#FF0000"]=[/color][color="#800000"]"Microsoft-Windows-Security-Auditing"[/color]; ID[color="#FF0000"]=[/color][color="#800000"]"4624"[/color]; Data[color="#FF0000"]=[/color][color="#800000"]"C:\Windows\System32\winlogon.exe"[/color]} [color="#008080"]-MaxEvents[/color] [color="#4B0082"]$me[/color] )
{ 	
	[color="#008000"]# Change date format to DD/MM/YYYY[/color]
	[color="#4B0082"]$newtime[/color] [color="#FF0000"]=[/color] [[color="#008080"]regex[/color]]::[color="#8B4513"]split[/color]([color="#4B0082"]$event[/color].timecreated, [color="#800000"]"/"[/color])
	[color="#4B0082"]$newtime[/color] [color="#FF0000"]=[/color] ([color="#4B0082"]$newtime[/color][1] [color="#FF0000"]+[/color] [color="#800000"]"/"[/color] [color="#FF0000"]+[/color] [color="#4B0082"]$newtime[/color][0] [color="#FF0000"]+[/color] [color="#800000"]"/"[/color] [color="#FF0000"]+[/color] [color="#4B0082"]$newtime[/color][2])
	[color="#008000"]# Take the timecreated and message values, strip out junk data and add to $fulllogs [/color]
	[color="#4B0082"]$fulllogs[/color] [color="#FF0000"]+=[/color] ([[color="#008080"]string[/color]][color="#800000"]"----------"[/color] [color="#FF0000"]+[/color] [color="#4B0082"]$newtime[/color] [color="#FF0000"]+[/color] [color="#800000"]"----------`r`n"[/color] [color="#FF0000"]+[/color] [color="#4B0082"]$event[/color].message [color="#FF0000"]+[/color] [color="#800000"]"`r`n"[/color] [color="#FF0000"]-replace[/color] [[color="#008080"]string[/color]][color="#800000"]"(?s)Detailed.*key was requested.", "---------- Event message end ----------`r`n`r`n"[/color])
}

[color="#008000"]# Write $fulllogs to $logfile[/color]
[color="#800000"]"Previous $me logon events for $fqdn `r`n`r`n $fulllogs"[/color] > [color="#4B0082"]$logFile[/color]
[color="#008000"]# Open $Logfile. Wait for file to close before proceeding.[/color]
[color="#008080"]Start-Process[/color] [color="#4B0082"]$logFile[/color] [color="#008080"]-wait[/color]
[color="#008000"]# On file close, delete.[/color]
[color="#008080"]Remove-Item[/color] [color="#4B0082"]$logFile[/color] 

 

You'll likely need to change how it generates $fqdn (line 3) and where $logfile is saved to (line 8), but there's the script.

Remember, Powershell version 2!

(cmd.exe

> powershell -version 2)

Edited September 20, 2013 by Garacesh