Powershell 事件日志代码 csv 输出

Question

我有几台服务器要从中获取事件日志数据。 我想要的只是每天按事件 ID 和事件发生次数分组的每个事件。然后将信息存储在通过电子邮件发送给我的 CSV 文件中。 我能够将此信息放入 CSV 文件中，但即使我包含 -NoTypeInformation，似乎也找不到删除类型信息的方法。我对数据的呈现方式进行了各种修改，但如果我将其导出到 txt 文件，它似乎会出现文件。请推荐一个解决方案。 我知道 get-eventlog 语句此时有 2 个 export-csv 语句，因为我正在尝试我在网上看到的示例中的帖子。

$hostname = hostname
$Filecsv = new-item -type file -path "c:\PowershellData\$hostname$(get-date -format hhmmddss).csv"

#$Filetxt = new-item -type file -path "c:\PowershellData\$hostname$(get-date -format hhmmddss).txt"
$yesterday = [DateTime]::Today.AddDays(-1).AddHours(00)
$Today = [DateTime]::Today.AddDays(-1).AddHours(24)

#Get-Eventlog -Logname Application | Where-Object {$_.Timegenerated -ge (Get-Date).AddDate(-1)} | Export-Csv Temp.csv -Encoding Unicode
#[System.IO.File]::ReadAllText("Temp.csv") | Out-File $Filecsv -Append -Encoding Unicode 

#$applog = 
get-eventlog -log application -after $yesterday  -before $Today| group-object -property {$_.EventID} -noelement | export-csv Temp.csv -NoTypeInformation -Delimiter "," -Encoding Unicode
[System.IO.File]::ReadAllText("Temp.csv") | Out-File $Filecsv -Append -Encoding Unicode 


get-eventlog -log System -after $yesterday  -before $Today| group-object -property {$_.EventID} -noelement  | Export-Csv Temp.csv -Encoding Unicode
[System.IO.File]::ReadAllText("Temp.csv") | Out-File $Filecsv -Append -Encoding Unicode 
get-eventlog -log security -after $yesterday  -before $Today| group-object -property {$_.EventID} -noelement  | Export-Csv Temp.csv -Encoding Unicode
[System.IO.File]::ReadAllText("Temp.csv") | Out-File $Filecsv -Append -Encoding Unicode 

$CredUser = "PowershellData@CompanyName.com"
$CredPassword = Read-host "What is your password?" # -AsSecureString
$smtpServer = "smtp.ExchangeServer.com"
$smtp = new-object Net.Mail.SmtpClient($smtpServer, 587)
$att = new-object Net.Mail.Attachment($Filecsv)
$msg = new-object Net.Mail.MailMessage
$msg.From = "PowershellData@CompanyName.com"
$msg.To.Add("PowershellData@CompanyName.com")
$msg.Subject = "$hostname Server Event logs Information $yesterday  to $today"
$msg.Body = "Event logs. "
$msg.Attachments.Add($att)
$smtp.EnableSsl = $true 
$smtp.Credentials = New-Object System.Net.NetworkCredential($CredUser, $CredPassword);
$smtp.Send($msg)
$att.Dispose()

Answer 1

如果您只想要所有日志的总数，您可以这样做：

$csv   = "C:\PowershellData\$env:COMPUTERNAME$(Get-Date -Format hhmmddss).csv"
$today = (Get-Date).Date
$logs  = 'Application', 'System', 'Security'

$logs | % { Get-Eventlog -Log $_ -After $today.AddDays(-1) -Before $today } `
  | group EventID `
  | select @{n='EventID';e={[int]($_.Name)}}, Count `
  | sort @{e='Count';d=$true}, @{e='EventID';d=$false} `
  | Export-Csv $csv -NoType

如果您想要每个日志的数字，我会在结果中包含日志名称：

$csv   = "C:\PowershellData\$env:COMPUTERNAME$(Get-Date -Format hhmmddss).csv"
$today = (Get-Date).Date
$logs  = 'Application', 'System', 'Security'

$logs | % {
  $log = $_
  Get-Eventlog -Log $log -After $today.AddDays(-1) -Before $today `
    | group EventID `
    | select @{n='Log';e={$log}}, @{n='EventID';e={[int]($_.Name)}}, Count `
    | sort @{e='Count';d=$true}, @{e='EventID';d=$false}
} | Export-Csv $csv -NoType

Answer 2

这将创建 3 个 csv 文件，每个日志文件一个：

'application','system','security' | foreach{
    get-eventlog -log $_ -After ([datetime]::today) | 
    group eventid -noel | sort count -desc | 
    export-csv "eventLog_$_.csv" -notype
}

Answer 3

如果我没看错，我认为这可能有效：

$Today = Get-Date
$yesterday = (Get-Date).AddDays(-1)

filter hash-events 
 { $Event_ht[$_.EventID]++ }

foreach ($log in 'System','Application','Security')
   {
    $Event_ht = @{}
    get-eventlog -logname $log -after $yesterday  -before $Today | hash-events

    $(foreach ($EventID in $Event_ht.keys)
      {
        [PSCustomObject]@{EventID = $EventID;Count=$Event_ht[$EventID]}
      }) | 
           Export-Csv "$log.csv" -NoTypeInformation
  }

过滤器确实有点不合常规，但它在管道中比 foreach-object 更快。