#------------begin script-----------------------------
$TimeStamp = Get-Date -UFormat "%Y%m%d_%H%M" # Get date/time stamp of script runtime
$myScriptPath = "\\System\Shared" # Path of the script
$myName = $env:computername # Get the name of the host you are running this on
$myTargetEventLog = "application" # Set the event log you wish to poll
$myProviderName = "*Microsoft Forefront TMG*" # Set the Provider Name you wish to filter on
$myStartTime= ((get-date).AddDays(-3)) # Set the time of the oldest log you wish to return
$myEndTime = (get-date) # Set the time of the newest log you wish to return
$myLogName = "TMGLOGS_" + $myName + "_" + $TimeStamp + ".csv" # Set the name of the results file
$myLog = New-Item -ItemType file -Path $myScriptPath -name $myLogName -Force # Set the path of the results file
Get-WinEvent -computername $myName -FilterHashtable @{logname=$myTargetEventLog;ProviderName=$myProviderName;StartTime=$myStartTime;EndTime=$myEndTime} | `
Select-Object MachineName,TimeCreated,ID,Message | Export-Csv –path $myLog -notype
#------------end script-------------------------------
POWERSHELL: Search the Event Log on a local machine
Posted by
Jeremy
No comments:
Post a Comment