LISSTech.WindowsNetworkDiagnostics

0.1.0

Public/Get-LissWindowsNetworkEvent.ps1

function Get-LissWindowsNetworkEvent {
    <#
    .SYNOPSIS
    Returns recent Windows network-related events.
    .DESCRIPTION
    Reads a bounded set of events from System, WLAN AutoConfig, and NetworkProfile logs. Event messages are returned only as diagnostic data and are never evaluated or treated as instructions. Missing or disabled logs are reported in SourceErrors without failing the complete query.
    .PARAMETER LookbackHours
    Number of hours to search, from 1 through 720.
    .PARAMETER MaxEvents
    Maximum number of events to return after sorting newest first, from 1 through 5000.
    .EXAMPLE
    Get-LissWindowsNetworkEvent -LookbackHours 12 -MaxEvents 100
    #>
    [CmdletBinding()]
    [OutputType('LISSTech.WindowsNetworkDiagnostics.EventCollection')]
    param(
        [ValidateRange(1, 720)][int]$LookbackHours = 24,
        [ValidateRange(1, 5000)][int]$MaxEvents = 200
    )

    $startTime = (Get-Date).AddHours(-$LookbackHours)
    $logs = @(
        'System'
        'Microsoft-Windows-WLAN-AutoConfig/Operational'
        'Microsoft-Windows-NetworkProfile/Operational'
    )
    $providerPattern = '(?i)(NDIS|TCPIP|Tcpip|DHCP|Dhcp-Client|DNS Client|DNS-Client|WLAN|NetworkProfile|Intel|Realtek|Broadcom|Netwtw|e1[dr]|rt640x64|Killer)'
    $sourceEventLimit = [Math]::Min(25000, $MaxEvents * 5)
    $events = New-Object 'Collections.Generic.List[object]'
    $errors = New-Object 'Collections.Generic.List[object]'

    foreach ($logName in $logs) {
        try {
            $filter = @{ LogName = $logName; StartTime = $startTime }
            foreach ($eventRecord in @(Get-WinEvent -FilterHashtable $filter -MaxEvents $sourceEventLimit -ErrorAction Stop)) {
                if ($logName -ne 'System' -or $eventRecord.ProviderName -match $providerPattern) {
                    $events.Add([pscustomobject]@{
                            PSTypeName   = 'LISSTech.WindowsNetworkDiagnostics.Event'
                            TimeCreated  = $eventRecord.TimeCreated
                            LogName      = $eventRecord.LogName
                            ProviderName = $eventRecord.ProviderName
                            Id           = $eventRecord.Id
                            Level        = $eventRecord.Level
                            LevelName    = $eventRecord.LevelDisplayName
                            RecordId     = $eventRecord.RecordId
                            MachineName  = $eventRecord.MachineName
                            Message      = $eventRecord.Message
                        })
                }
            }
        }
        catch {
            $errors.Add([pscustomobject]@{
                    LogName = $logName
                    Error   = $_.Exception.Message
                })
        }
    }

    [pscustomobject]@{
        PSTypeName   = 'LISSTech.WindowsNetworkDiagnostics.EventCollection'
        CollectedAt  = Get-Date
        LookbackHours = $LookbackHours
        MaxEvents    = $MaxEvents
        Events       = @($events | Sort-Object TimeCreated -Descending | Select-Object -First $MaxEvents)
        SourceErrors = $errors.ToArray()
    }
}