在 PowerShell 脚本中显示事件日志 XML 参数

Question

我有一个 PowerShell 脚本，它从事件查看器获取 RDP 连接的登录历史记录，然后将其放入 CSV 文件中。我想在表中包含 Correlation ActivityID，我可以在 XML 视图中看到它。

Screenshot of the event log

Param(
[array]$ServersToQuery = (hostname),
[datetime]$StartTime = "January 1, 1970"
)

foreach ($Server in $ServersToQuery) {

    $LogFilter = @{
        LogName = 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'
        ID = 21, 23, 24, 25
        StartTime = $StartTime
        }

    $AllEntries = Get-WinEvent -FilterHashtable $LogFilter -ComputerName $Server

    $AllEntries | Foreach { 
        $entry = [xml]$_.ToXml()
        [array]$Output += New-Object PSObject -Property @{
            TimeCreated = $_.TimeCreated
            User = $entry.Event.UserData.EventXML.User
            IPAddress = $entry.Event.UserData.EventXML.Address
            EventID = $entry.Event.System.EventID
            ServerName = $Server
            }        
        } 

}

$FilteredOutput += $Output | Select TimeCreated, User, ServerName, IPAddress, @{Name='Action';Expression={
            if ($_.EventID -eq '21'){"logon"}
            if ($_.EventID -eq '22'){"Shell start"}
            if ($_.EventID -eq '23'){"logoff"}
            if ($_.EventID -eq '24'){"disconnected"}
            if ($_.EventID -eq '25'){"reconnection"}
            }
        }

$Date = (Get-Date -Format s) -replace ":", "."
$FilePath = "$env:USERPROFILE\Desktop\$Date`_RDP_Report.csv"
$FilteredOutput | Sort TimeCreated | Export-Csv $FilePath -NoTypeInformation

Write-host "Writing File: $FilePath" -ForegroundColor Cyan
Write-host "Done!" -ForegroundColor Cyan

任何想法我如何实现这一目标？

Answer 1

您可以像其他值一样使用点索引：

[array]$Output += New-Object PSObject -Property @{
    TimeCreated = $_.TimeCreated
    ActivityID  = $entry.Event.System.Correlation.ActivityID     # here
    User        = $entry.Event.UserData.EventXML.User
    IPAddress   = $entry.Event.UserData.EventXML.Address
    EventID     = $entry.Event.System.EventID
    ServerName  = $Server
}