POWERSHELL: Search the Event Log on a local machine

#------------begin script-----------------------------

$TimeStamp = Get-Date -UFormat "%Y%m%d_%H%M" # Get date/time stamp of script runtime
$myScriptPath = "\\System\Shared"  # Path of the script
$myName = $env:computername   # Get the name of the host you are running this on
$myTargetEventLog = "application"  # Set the event log you wish to poll
$myProviderName = "*Microsoft Forefront TMG*" # Set the Provider Name you wish to filter on
$myStartTime= ((get-date).AddDays(-3))  # Set the time of the oldest log you wish to return
$myEndTime = (get-date)    # Set the time of the newest log you wish to return
$myLogName = "TMGLOGS_" + $myName + "_" + $TimeStamp + ".csv"  # Set the name of the results file
$myLog = New-Item -ItemType file -Path $myScriptPath -name $myLogName -Force # Set the path of the results file 

Get-WinEvent -computername $myName -FilterHashtable @{logname=$myTargetEventLog;ProviderName=$myProviderName;StartTime=$myStartTime;EndTime=$myEndTime} | `
 Select-Object MachineName,TimeCreated,ID,Message | Export-Csv –path $myLog -notype

#------------end script-------------------------------

No comments:

Post a Comment