Event log script

[noelmm]

Hi everyone,

 

I've been trying to remotely access some event logs from a mcahine and the have them save to a folder on my D drive. I have been able to do this using the following script.

 

 

cls

$Machine = "Computer1"

Get-service -computername $Machine -name RemoteRegistry

Set-Service -ComputerName $Machine -InputObject RemoteRegistry -StartupType Automatic

Get-service -computername $Machine -name RemoteRegistry

Get-EventLog -LogName Application -Newest 30 -ComputerName $Machine | Out-File -FilePath "D:\Test\Application Event Logs.txt"

Get-EventLog -LogName System -Newest 30 -ComputerName $Machine | Out-File -FilePath "D:\Test\System Event Logs.txt"

 

 

 

 

When I have the file output the file is not complete i.e. the event entry looks like this

 

 

 

44392 May 13 15:01 Information ESENT 103 svchost (5332) Instance: The database engine stopped the instance (0)....

44391 May 13 15:01 Information ESENT 327 svchost (5332) Instance: The database engine detached a database (1, C:\ProgramData...

44390 May 13 14:58 Information gupdate 0 The description for Event ID '0' in Source 'gupdate' cannot be found. The local co...

44389 May 13 14:56 0 Software Protecti... 1073742727 The Software Protection service has stopped....

44388 May 13 14:56 Information Software Protecti... 1073758208 Successfully scheduled Software Protection service for re-start at 2016-05-18T07:00...

 

 

 

 

As you can see the whole line of text is not complete.

 

 

Does anyone know how to get the whole event entry to be output rather than just a section of it? Or is is possible to save the file in the .evtx format so it can be opened in the event viewer application? When I just change the file extension to .evtx the file is created but when opened it is unreadable.

 

Finally how would I put the Machine name into the output file name i.e. "D:\Test\System Event Logs.txt - $Machine"?

 

Thanks for any help you can offer

 

Noel

[steve]

Hi,

 

What you are experiencing is powershells inbuild format tables. When doing a Get-EventLog, there is an inbuilt format for the output that applies to screen (host) or a file output.

 

You have a couple of optons, either change the output format (Format-Table) or output to different format - e.g. CSV.

 

Personal preference here would be to use CSV as you can manipulate the data easier in Excel.

 

For your Remote Registry service, I've tweeked the code below to check if it is started, if not update startup type and then start it:

 

cls
$Machine = "localhost"

if ((Get-service -computername $Machine -name RemoteRegistry).Status -eq "Stopped")
{
Set-Service -ComputerName $Machine -InputObject RemoteRegistry -StartupType Automatic
Invoke-Command {Start-Service RemoteRegistry –passthru} -ComputerName $Machine
$RemoteReg = "Remote Registry Service set to run automatically"
}

Else
{
$RemoteReg = "Remote Registry Service already running"
}

Get-EventLog -LogName Application -Newest 30 -ComputerName $Machine | Select-Object -Property Index,TimeGenerated,EntryType,Source,InstanceId,Message |
   Export-CSV -NoTypeInformation "D:\Test\ApplicationEventLogs$Machine.csv"
Get-EventLog -LogName System -Newest 30 -ComputerName $Machine | Select-Object -Property Index,TimeGenerated,EntryType,Source,InstanceId,Message |
   Export-CSV -NoTypeInformation "D:\Test\SystemEventLogs$Machine.csv"

 

For the machine name in the file path, powershell will display the variable name if you put it in a string between double speech marks "$variable" but not between single '$variable'

[noelmm]

Hi Steve,

 

Thanks for replying. The script you have provided works well and does what I need. I was wondering moving forward is there a way to have the file output an evtx file so that it can be opened with the event viewer natively as both a cvs and txt format are quite messy when reading?

 

Regards

 

Noel

[HPlum78]

Get-EventLog is not the quickest of cats, I would be tempted to use Get-WinEvent with the -FilterHashTable so something like what I have done in the past:

Get-WinEvent -FilterHashtable @{Logname='System'; StartTime=$date} -ErrorAction SilentlyContinue -ComputerName $_.Name | Select-Object * | ? {$_.ID -eq '1001' -and $_.ProviderName -eq 'Microsoft-Windows-WER-SystemErrorReporting'}

 

For the date you would have something like this:

$date = (Get-Date) - (New-TimeSpan -day 30)

 

and the filter well I was looking for servers that had bugchecked but you can dispense of that where clause or if you are looking for something then make your own.

 

and the last thing is to output it somewhere so a | on the end with export-csv -NoTypeInformation -Path c:\local\scripts\out or \\yourlogserver\scripts\wineventsearch\$SrvName.csv you get the picture I am sure.

 

If you want to see the difference in speed between get-eventlog and get-winevent put it inside of measure-command and see what you get.

 

Hope this is useful.

 

H

[noelmm]

Hi HPlum78,

 

Thanks for the reply. I'll take a look into this method. I have also been playing about with the wvetutil command which outputs directly into the evtx format.

 

Noel