Public/Invoke-EventLogs.ps1
|
function Invoke-EventLogs { <# .SYNOPSIS Gets event logs from a computer. .PARAMETER ComputerName Target computer .EXAMPLE !logs stnjn109.sunssc.local #> [PoshBot.BotCommand( CommandName = 'events', Aliases = ('event', 'logs', 'log', 'eventlog') )] [cmdletbinding()] param( [parameter(Mandatory)] [string]$ComputerName ) Begin { Write-Verbose "$(Get-Date) - Started." $HoursBack = 24 $AllResults = @() } Process { foreach ($Computer in $ComputerName) { $Result = $Null write-verbose "$(Get-Date) - Working on $Computer - Eventlog" $starttime = (Get-Date).AddHours(-$HoursBack) try { write-verbose "$(Get-Date) - Trying with Get-WinEvent" $result = Get-WinEvent -ErrorAction stop -Credential $credential -ComputerName $Computer -filterh @{LogName = (Get-WinEvent -Computername $Computer -ListLog * | Where-Object { ($_.logtype -eq 'administrative') -and ($_.logisolation -eq 'system') } | Where-Object recordcount).logname; StartTime = $starttime; Level = 1, 2 } | Select-Object machinename, timecreated, providername, logname, id, leveldisplayname, message } catch [System.Diagnostics.Eventing.Reader.EventLogException] { switch -regex ($_.Exception.Message) { "RPC" { Write-Warning "$(Get-Date) - RPC error while communicating with $Computer" $Result = 'RPC error' } "Endpoint" { write-verbose "$(Get-Date) - Trying with Get-EventLog for systems older than Windows 2008" try { $sysevents = Get-EventLog -ComputerName $Computer -LogName system -Newest 1000 -EntryType Error -ErrorAction Stop | Where-Object TimeGenerated -gt $starttime | Select-Object MachineName, @{Name = 'TimeCreated'; Expression = { $_.TimeGenerated } }, @{Name = 'ProviderName'; Expression = { $_.Source } }, LogName, @{Name = 'Id'; Expression = { $_.EventId } }, @{Name = 'LevelDisplayName'; Expression = { $_.EntryType } }, Message if ($sysevents) { $result = $sysevents } else { Write-Warning "$(Get-Date) - No events found on $Computer" $result = 'none' } } catch { $Result = 'error' } } Default { Write-Warning "$(Get-Date) - Error retrieving events from $Computer" } } } catch [Exception] { Write-Warning "$(Get-Date) - No events found on $Computer" $result = 'none' } if (($result -ne 'error') -and ($result -ne 'RPC error') -and ($result -ne 'none')) { Write-Verbose "$(Get-Date) - Consolidating events for $Computer" $lastuniqueevents = $null $lastuniqueevents = @() $ids = ($result | Select-Object id -unique).id foreach ($id in $ids) { $machineevents = $result | Where-Object id -eq $id $lastuniqueevents += $machineevents | Sort-Object timecreated -Descending | Select-Object -first 1 $lastuniqueevents | Add-Member -MemberType NoteProperty -Name "NumEvents" -Value ($machineevents | Measure-Object).Count -Force } $AllResults += $lastuniqueevents | Select-Object MachineName, NumEvents, TimeCreated, ProviderName, LogName, Id, LevelDisplayName, Message } } } End { Write-Verbose "$(Get-Date) - Finished." $AllResults New-PoshBotCardResponse -Text ($AllResults | format-list -property * | out-string) -Title "Administrative events from $computername in the last 24 hours" } } |