EventTest.ps1

something exciting

Some information about the exciting thing

Table of contents generated with markdown-toc


Script

<#
.Synopsis
	Compare event log access using Get-EventLog and Get-WinEvent.

	Public Domain. Use at your own risk.  Author makes no warranties
	and assumes no liabilities.
.Notes
    Name:       EventTest.ps1
    Author:     Mark Berry, MCB Systems, http://www.mcbsys.com
	Created:    04/01/2011
    Last Edit:  04/01/2011
.Description
	First, get Warning and Error events from the last 24 hours from the specified
	machine, first using Get-EventLog, then using Get-WinEvent.
	Second, get Audit Failure events  from the last 24 hours from the specified
	machine, first using Get-EventLog, then using Get-WinEvent.
	Output how long each query takes to the console.
#>

# Usage:  start PowerShell as Administrator.  In the $ComputerName variable below,
# type the name of a Vista or later computer on your network that allows remote
# event log queries.  Or just use the default to run against the local machine.
$ComputerName = $env:computername
# $ComputerName = "SERVER01"

# Test Application log with Get-EventLog
$StopWatch = [Diagnostics.Stopwatch]::StartNew()
$StartTime = [DateTime]::Now.AddHours( - 24)
$IncludeEntryTypes = ("Warning", "Error")
[array] $Events = @()
$Events += Get-EventLog -ComputerName $ComputerName -LogName Application -After $StartTime | Where-Object { ($IncludeEntryTypes -contains $_.EntryType) }
$StopWatch.Stop()
Write-Host $ComputerName ":  Get-EventLog on Application log found" $Events.Count "events. Elapsed time:" $StopWatch.Elapsed

# Test Application log with Get-WinEvent
$StopWatch = [Diagnostics.Stopwatch]::StartNew()
$XMLFilter = @'
<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[(Level=2 or Level=3)
	  and TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]</Select>
  </Query>
</QueryList>
'@
[array] $Events = @()
$Events += Get-WinEvent -ComputerName $ComputerName -FilterXml $XMLfilter
$StopWatch.Stop()
Write-Host $ComputerName ":  Get-WinEvent on Application log found" $Events.Count "events. Elapsed time:" $StopWatch.Elapsed

# Test Security log with Get-EventLog
$StopWatch = [Diagnostics.Stopwatch]::StartNew()
$StartTime = [DateTime]::Now.AddHours( - 24)
$IncludeEntryTypes = ("FailureAudit")
[array] $Events = @()
$Events += Get-EventLog -ComputerName $ComputerName -LogName Security -After $StartTime | Where-Object { ($IncludeEntryTypes -contains $_.EntryType) }
$StopWatch.Stop()
Write-Host $ComputerName ":  Get-EventLog on Security log found" $Events.Count "events. Elapsed time:" $StopWatch.Elapsed


# Test Security log with Get-WinEvent
$StopWatch = [Diagnostics.Stopwatch]::StartNew()
$XMLFilter = @'
<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[band(Keywords,4503599627370496)
	  and TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]</Select>
  </Query>
</QueryList>
'@
[array] $Events = @()
$Events += Get-WinEvent -ComputerName $ComputerName -FilterXml $XMLfilter
$StopWatch.Stop()
Write-Host $ComputerName ":  Get-WinEvent on Security log found" $Events.Count "events. Elapsed time:" $StopWatch.Elapsed

Back to Top


Download

Please feel free to copy parts of the script or if you would like to download the entire script, simple click the download button. You can download the complete repository in a zip file by clicking the Download link in the menu bar on the left hand side of the page.


Report Issues

You can report an issue or contribute to this site on GitHub. Simply click the button below and add any relevant notes. I will attempt to respond to all issues as soon as possible.

Issue


Back to Top