Sometimes you may need to analyze system files to transfer them to the hard drive, or you want to read the system log directly from "EVTX".
You can do this:
Copy Code code as follows:
$path = "$env: windir\system32\winevt\logs\setup.evtx"
Get-winevent-path $path
Another piece of code to get the system log
Copy Code code as follows:
$StartTime = (get-date). Date + (new-timespan-hours 6-minutes 35)
$EndTime = (get-date). Date + (new-timespan-hours 6-minutes 36)
$global: Taskstart
$Global: Taskcomplete
$Global: Events
$Global: Event
$Global: Timespent
$Global: events = get-winevent-filterhashtable @{logname = "microsoft-windows-taskscheduler/operational"; id=107; Starttime= $StartTime; Endtime= $EndTime}
Foreach ($Global: Event in $Global: events)
{
Cls
$StartLogs =get-winevent-filterhashtable @{logname = "microsoft-windows-taskscheduler/operational"; ID=100; Starttime= $StartTime}
$CompleteLogs =get-winevent-filterhashtable @{logname = "microsoft-windows-taskscheduler/operational"; id=102; Starttime= $StartTime}
$global: taskstart= $StartLogs | where {$_. Activityid-eq $Global: Event. ActivityID}
$Global: taskcomplete= $CompleteLogs | where {$_. Activityid-eq $Global: Event. ActivityID}
$global: timespent= ($global: taskcomplete.timecreated-$global: taskstart.timecreated). Totalminutes
if (($global: Taskstart-ne $NULL)-and ($Global: Taskcomplete-ne $null)-and ($Global: timespent-gt 1)) {
$Messagebody = "Sync task started at:" + $global: taskstart.timecreated.datetime+ "' R ' N"
$Messagebody = $Messagebody + "' R ' NSync task completed at:" + $global: taskcomplete.timecreated.datetime+ "' R ' N"
$Messagebody = $Messagebody + "' r ' Ntask lasted for" + ("{0:n2}"-F ($Global: timespent)) + "Minutes"
Send-mailmessage-from "CustomerLog@avepoint.com"-to "Zhijie.bai@avepoint.com", "Infrastructure_cn@avepoint.com"- Subject "Customer Logs Sync report:success"-body $Messagebody-smtpserver "10.100.100.153"-encoding UTF8
}
else{
$Messagebody = "######################################################################## ' r ' n"
$Messagebody = $Messagebody + "' R ' ncustom logs sync failed, please login 10.2.0.125 to check and sync again ' R ' n"
$Messagebody = $Messagebody + "' R ' n######################################################################## ' r ' n"
Send-mailmessage-from "CustomerLog@avepoint.com"-to "Zhijie.bai@avepoint.com", "Infrastructure_cn@avepoint.com"- Subject "Customer Logs Sync report:failed"-body $Messagebody-smtpserver "10.100.100.153"-encoding utf8-priority High
}
}
Support all versions of PowerShell
