将我的事件查看器表转换为 HTML 表答案

【问题标题】：Turning my Event Viewer table into an HTML table将我的事件查看器表转换为 HTML 表
【发布时间】：2021-08-16 20:58:37
【问题描述】：

我有一个简短的命令来显示一些事件查看器信息。我想将其转换为 HTML 表格以输出为我将抓取并放入电子邮件报告的 txt 文件。到目前为止，我有：

$endTime = Get-Date
$startTime = $endTime.AddDays(-1)
$table =Get-WinEvent -FilterHashtable @{LogName='Security';StartTime=$startTime;EndTime=$endTime;} | Where-Object {$_.ID -ne 4624 -and $_.ID -ne 4672 -and $_.ID -ne 4634}

这个输出


   ProviderName: Microsoft-Windows-Security-Auditing

TimeCreated                     Id LevelDisplayName Message                                                                                                                                                
-----------                     -- ---------------- -------                                                                                                                                                
8/16/2021 11:37:41 AM         4648 Information      A logon was attempted using explicit credentials....                                                                                                   
8/16/2021 11:37:40 AM         4648 Information      A logon was attempted using explicit credentials....                                                                                                   
8/16/2021 11:37:39 AM         5061 Information      Cryptographic operation....                                                                                                                            
8/16/2021 11:37:39 AM         5058 Information      Key file operation....                                                                                                                                 
8/16/2021 10:06:32 AM         4648 Information      A logon was attempted using explicit credentials....                                                                                                   
8/16/2021 10:06:32 AM         4648 Information      A logon was attempted using explicit credentials....                                                                                                   
8/16/2021 10:06:32 AM         4648 Information      A logon was attempted using explicit credentials....                                                                                                   
8/16/2021 10:06:31 AM         4648 Information      A logon was attempted using explicit credentials....

当我使用 convertto-html 管道该变量时，它现在输出：

S C:\Windows\system32> $htmlTable
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>HTML TABLE</title>
</head><body>
<table>
<colgroup><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/><col/></colgroup>
<tr><th>Message</th><th>Id</th><th>Version</th><th>Qualifiers</th><th>Level</th><th>Task</th><th>Opcode</th><th>Keywords</th><th>RecordId</th><th>ProviderName</th><th>ProviderId</th><th>LogName</th><th>P
rocessId</th><th>ThreadId</th><th>MachineName</th><th>UserId</th><th>TimeCreated</th><th>ActivityId</th><th>RelatedActivityId</th><th>ContainerLog</th><th>MatchedQueryIds</th><th>Bookmark</th><th>LevelDi
splayName</th><th>OpcodeDisplayName</th><th>TaskDisplayName</th><th>KeywordsDisplayNames</th><th>Properties</th></tr>
<tr><td>A logon was attempted using explicit credentials.

Subject:
    Security ID:        S-1-5-18
    Account Name:       account name
    Account Domain:     domain
    Logon ID:       *****
    Logon GUID:     {*****************}

Account Whose Credentials Were Used:
    Account Name:       account name
    Account Domain:     domain
    Logon GUID:     {*********************}

Target Server:
    Target Server Name: localhost
    Additional Information: localhost

Process Information:
    Process ID:     ******
    Process Name:       C:\Windows\System32\winlogon.exe

Network Information:
    Network Address:    **********
    Port:           ***

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, 
or when using the RUNAS command.</td><td>4648</td><td>0</td><td></td><td>0</td><td>12544</td><td>0</td><td>-**********************</td><td>10364891</td><td>Microsoft-Windows-Security-Auditing</td><td>*****
******************</td><td>Security</td><td>***</td><td>****</td><td>*************</td><td></td><td>8/16/2021 11:37:41 AM</td><td></td><td></td><td>security</td><td>System.UInt32
[]</td><td>System.Diagnostics.Eventing.Reader.EventBookmark</td><td>Information</td><td>Info</td><td>Logon</td><td>System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]</td><td>System.Collec
tions.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]</td></tr>

我真的只想要第一个命令提供的信息，而不需要 converto-html 命令提供的所有额外信息。

【问题讨论】：

在将日志传递给ConvertTo-Html之前选择要导出的属性，试试Get-WinEvent .... | where {....} | Select-Object TimeCreated, Id, LevelDisplayName, Message | ConvertTo-Html

标签： html powershell event-viewer

【解决方案1】：

实际上，按设计工作。试试 $table[0].message 你会明白为什么，并检查完整的消息是否在 td /td 中，这意味着从 HTML 的角度来看是好的。如果您只需要消息的第一行，则应拆分消息属性并仅显示第一行。

【讨论】：