INTELLIGENT WORK FORUMS
FOR COMPUTER PROFESSIONALS

Log In

Come Join Us!

Are you a
Computer / IT professional?
Join Tek-Tips Forums!
  • Talk With Other Members
  • Be Notified Of Responses
    To Your Posts
  • Keyword Search
  • One-Click Access To Your
    Favorite Forums
  • Automated Signatures
    On Your Posts
  • Best Of All, It's Free!

*Tek-Tips's functionality depends on members receiving e-mail. By joining you are opting in to receive e-mail.

Posting Guidelines

Promoting, selling, recruiting, coursework and thesis posting is forbidden.

Jobs

Powershell Script to get Windows Events info to Excel format

Powershell Script to get Windows Events info to Excel format

Powershell Script to get Windows Events info to Excel format

(OP)
I have below powershell script for windows events to query, trying to write this script to get the Compueter name, Event ID, Source and description info to excel.

Looking for help to finish this script. This script to run on list of computers also.

CODE -->

$servers = get-content “c:\list.txt”
foreach ($server in $servers)
{
$server
Get-EventLog -LogName APPLICATION |Source "ACECLIENT" AND Where-Object { $_.EventID -eq 1001 } # I am not sure how to include here description "looking for 'File not found: C:\Program Files\Microsoft ISA Server\SDCONFIG.'" 

}

RE: Powershell Script to get Windows Events info to Excel format

(OP)
I have done small changes to get the last five days events only but the script not showing any results.... Can any one help me here... pls...

CODE -->

$servers = get-content “C:\list.txt”
$OututPath="C\OUTPUT.csv"
$fromtime = (get-date).Adddays(-5)
get-eventlog -log Application -comp $servers | where {$_.source -eq "Defrag" -AND $_.EventID -eq 258 -and $_.message -like "*The disk defragmenter successfully*" -AND $_.TimeGenerated -EQ $FROMTIME  } | Export-Csv $OututPath -NoTypeInformation 

# The Problem is I want to get the events for only last 5 days, When i added "-AND $_.TimeGenerated -EQ $FROMTIME" the output is not comming it is taking lot of time but not results. I think some logic problem.. Can any one help me here...

RE: Powershell Script to get Windows Events info to Excel format

I dont know powershell very well but the two post are completely different to each other.
You need to check out examples e.g. get-help get-eventlog -examples or get-help get-eventlog -Full
First of all this does not work

CODE -->

$servers = get-content “c:\list.txt”
foreach ($server in $servers)
{
$server 
below
this reads the file and sorts it in descending order obviously i'm using write-host as to see the output.

CODE -->

$servers = get-content “c:\lists.txt”
Write-Host
$servers | sort-object -descending 
APPLICATION |Source "ACECLIENT" means the name of the app in application log. but in the second one you list defrag and different event ID's

Do you know what event ID the file is causing in the event log? Is it application or system log, and what type of error are you looking for etc

You may want to work on this below then you can add variables [$events = Get=Eventlog blah blah] formating etc, and then worry about the output.

CODE -->

Get-EventLog -LogName "Application" -EntryType Error -After ((Get-Date).Date.AddDays(-5)) 

MCITP:EA/SA, MCSE, MCSA, MCDBA, MCTS, MCP+I, MCP

RE: Powershell Script to get Windows Events info to Excel format

Going to need some help here.
What I did manage to do but testing is difficult since my admin privileges where taken away. [company expanded new it manager.]
This bit now works, reading computers and running against them, just output issue to resolve.

CODE -->

clear-host
$servers = get-content “c:\lists.txt”
$array = $servers
foreach ($computers in $array)
{
write-host $computers
} 
This bit gives the two html files with the correct names but same content

CODE -->

clear-host
$style = ""
$style = $style + "Body{background-color:white;font-family:Arial;font-size:10pt;}" 
$style = $style + "Table{border-width: 1px; border-style: solid; border-color: black; border-collapse: collapse;}" 
$style = $style + "TH{border-width: 1px; padding: 2px; border-style: solid; border-color: black; background-color: #cccccc;}" 
$style = $style + "TD{border-width: 1px; padding: 5px; border-style: solid; border-color: black; background-color: white;}" 
$style = $style + "" 
$date = get-date -format MM.dd.yyyy
$now = get-date
$subtractdays = New-Object System.Timespan 5,0,0,0,0
$then = $now.subtract($subtractDays)
$servers = get-content “c:\lists.txt”
$array = $servers
foreach ($computers in $array)
{
$strerror = Get-EventLog -LogName "System" -Computername $computers -After $then -Before $now -EntryType Error | 
select EventID,MachineName,Message,Source,TimeGenerated 
$strerror | ConvertTo-HTML -body $style | Out-file "C:\$computers.htm"
} 
and moving the strerror out the code blocks only produces one filename that of the last computer it runs on, or putting it in the code blocks or it's own foreach loop also gives me same content in both files, like I said cant really test.

MCITP:EA/SA, MCSE, MCSA, MCDBA, MCTS, MCP+I, MCP

RE: Powershell Script to get Windows Events info to Excel format

just pipe it

CODE -->

clear-host
$style = ""
$style = $style + "Body{background-color:white;font-family:Arial;font-size:10pt;}" 
$style = $style + "Table{border-width: 1px; border-style: solid; border-color: black; border-collapse: collapse;}" 
$style = $style + "TH{border-width: 1px; padding: 2px; border-style: solid; border-color: black; background-color: #cccccc;}" 
$style = $style + "TD{border-width: 1px; padding: 5px; border-style: solid; border-color: black; background-color: white;}" 
$style = $style + "" 
$date = get-date -format MM.dd.yyyy
$now = get-date
$subtractdays = New-Object System.Timespan 5,0,0,0,0
$then = $now.subtract($subtractDays)

# $cred = Get-credential

$servers = get-content “c:\lists.txt”
$array = $servers

 foreach ($computers in $array)
{
    Get-EventLog -LogName "System" -Computername $computers -After $then -Before $now -EntryType Error | 
        select EventID,MachineName,Message,Source,TimeGenerated |
         ConvertTo-HTML -body $style | Out-file "C:\$computers.htm"

} 

MCITP:EA/SA, MCSE, MCSA, MCDBA, MCTS, MCP+I, MCP

Red Flag This Post

Please let us know here why this post is inappropriate. Reasons such as off-topic, duplicates, flames, illegal, vulgar, or students posting their homework.

Red Flag Submitted

Thank you for helping keep Tek-Tips Forums free from inappropriate posts.
The Tek-Tips staff will check this out and take appropriate action.

Reply To This Thread

Posting in the Tek-Tips forums is a member-only feature.

Click Here to join Tek-Tips and talk with other members!

Resources

Close Box

Join Tek-Tips® Today!

Join your peers on the Internet's largest technical computer professional community.
It's easy to join and it's free.

Here's Why Members Love Tek-Tips Forums:

Register now while it's still free!

Already a member? Close this window and log in.

Join Us             Close