Public/Get-LissWindowsNetworkEvent.ps1
|
function Get-LissWindowsNetworkEvent { <# .SYNOPSIS Returns recent Windows network-related events. .DESCRIPTION Reads a bounded set of events from System, WLAN AutoConfig, and NetworkProfile logs. Event messages are returned only as diagnostic data and are never evaluated or treated as instructions. Missing or disabled logs are reported in SourceErrors without failing the complete query. .PARAMETER LookbackHours Number of hours to search, from 1 through 720. .PARAMETER MaxEvents Maximum number of events to return after sorting newest first, from 1 through 5000. .EXAMPLE Get-LissWindowsNetworkEvent -LookbackHours 12 -MaxEvents 100 #> [CmdletBinding()] [OutputType('LISSTech.WindowsNetworkDiagnostics.EventCollection')] param( [ValidateRange(1, 720)][int]$LookbackHours = 24, [ValidateRange(1, 5000)][int]$MaxEvents = 200 ) $startTime = (Get-Date).AddHours(-$LookbackHours) $logs = @( 'System' 'Microsoft-Windows-WLAN-AutoConfig/Operational' 'Microsoft-Windows-NetworkProfile/Operational' ) $providerPattern = '(?i)(NDIS|TCPIP|Tcpip|DHCP|Dhcp-Client|DNS Client|DNS-Client|WLAN|NetworkProfile|Intel|Realtek|Broadcom|Netwtw|e1[dr]|rt640x64|Killer)' $sourceEventLimit = [Math]::Min(25000, $MaxEvents * 5) $events = New-Object 'Collections.Generic.List[object]' $errors = New-Object 'Collections.Generic.List[object]' foreach ($logName in $logs) { try { $filter = @{ LogName = $logName; StartTime = $startTime } foreach ($eventRecord in @(Get-WinEvent -FilterHashtable $filter -MaxEvents $sourceEventLimit -ErrorAction Stop)) { if ($logName -ne 'System' -or $eventRecord.ProviderName -match $providerPattern) { $events.Add([pscustomobject]@{ PSTypeName = 'LISSTech.WindowsNetworkDiagnostics.Event' TimeCreated = $eventRecord.TimeCreated LogName = $eventRecord.LogName ProviderName = $eventRecord.ProviderName Id = $eventRecord.Id Level = $eventRecord.Level LevelName = $eventRecord.LevelDisplayName RecordId = $eventRecord.RecordId MachineName = $eventRecord.MachineName Message = $eventRecord.Message }) } } } catch { $errors.Add([pscustomobject]@{ LogName = $logName Error = $_.Exception.Message }) } } [pscustomobject]@{ PSTypeName = 'LISSTech.WindowsNetworkDiagnostics.EventCollection' CollectedAt = Get-Date LookbackHours = $LookbackHours MaxEvents = $MaxEvents Events = @($events | Sort-Object TimeCreated -Descending | Select-Object -First $MaxEvents) SourceErrors = $errors.ToArray() } } |