#------------begin script----------------------------- $TimeStamp = Get-Date -UFormat "%Y%m%d_%H%M" # Get date/time stamp of script runtime $myScriptPath = "\\System\Shared" # Path of the script $myName = $env:computername # Get the name of the host you are running this on $myTargetEventLog = "application" # Set the event log you wish to poll $myProviderName = "*Microsoft Forefront TMG*" # Set the Provider Name you wish to filter on $myStartTime= ((get-date).AddDays(-3)) # Set the time of the oldest log you wish to return $myEndTime = (get-date) # Set the time of the newest log you wish to return $myLogName = "TMGLOGS_" + $myName + "_" + $TimeStamp + ".csv" # Set the name of the results file $myLog = New-Item -ItemType file -Path $myScriptPath -name $myLogName -Force # Set the path of the results file Get-WinEvent -computername $myName -FilterHashtable @{logname=$myTargetEventLog;ProviderName=$myProviderName;StartTime=$myStartTime;EndTime=$myEndTime} | ` Select-Object MachineName,TimeCreated,ID,Message | Export-Csv –path $myLog -notype #------------end script-------------------------------
POWERSHELL: Search the Event Log on a local machine
Posted by
Jeremy
No comments:
Post a Comment