Question

出于某种原因，当我尝试使用安全选项时，它实际上并不执行get-eventlog cmdlet，而是将其写入屏幕，就像它被引用一样。其他日志在没有try catch块的情况下工作，但每当我使用try catch块设置它们时，它们仍然可以像引用cmdlet一样运行。

$eventlogname = Read-Host "Which event log category do wish to view? Enter Application, Security, Setup, System, or Forwarded events"
$lognumber = Read-Host "Enter the number of logs you wish to retrieve"

switch 
    ($eventlogname)
{
     Security {
            $logseverity = Read-Host "What event severity do you wish to view? Enter Critical, Warning, Error, FailureAudit, SuccessAudit, or Information"
            $computernameeventlog = Read-Host "Please enter the hostname to query"

            if ($computernameeventlog -eq "localhost" )
            {
            try
                {
                    {
                    Get-EventLog -logname $eventlogname -EntryType $logseverity -Newest $lognumber -ErrorAction SilentlyContinue
                    }


                            }
                            catch [System.IO.IOException]
                            {
                                Write-Host "The hostname was incorrect or not available."
                            }
                            catch [System.InvalidOperationException]
                            {
                                Write-Host "The event log does not exist"
                            }
                    }
             else
                {

             try{
                    {
                        Get-EventLog -logname $eventlogname -EntryType $logseverity -ComputerName $computernameeventlog -Newest $lognumber -ErrorAction SilentlyContinue 
                    }
                        }
                            catch [System.IO.IOException]
                            {
                                Write-Host "The hostname was incorrect or not available."
                            }
                            catch [System.InvalidOperationException]
                            {
                                Write-Host "The event log does not exist"
                            }
                    }
                }

     "Forwarded events"
     {
        $computernamewinevent = Read-Host "Please enter the hostname to query"
        $logseverity = Read-Host "What event severity do you wish to view? Enter Critical, Warning, Error or Information"
        if ($computernamewinevent -eq "localhost")
        {
            Get-WinEvent -logname forwardedevents -MaxEvents $lognumber | where {$_.leveldisplayname -contains $logseverity}
        }
        else
        {
            Get-WinEvent -logname forwardedevents -MaxEvents $lognumber -ComputerName $computername | where {$_.leveldisplayname -contains $logseverity}
        }
    }
    default
    {
    $logseverity = Read-Host "What event severity do you wish to view? Enter Critical, Warning, Error or Information"
    $computernameeventlog = Read-Host "Please enter the hostname to query"

    if ($computernameeventlog -eq "localhost" )

        {
            Get-EventLog -logname $eventlogname -EntryType $logseverity -Newest $lognumber 
        }



    else
        {
            Get-EventLog -logname $eventlogname -EntryType $logseverity -ComputerName $computernameeventlog -Newest $lognumber
        }
}
}

Answer 1

在您的代码中，您已使用括号（{ }）包围命令，例如：

{
Get-EventLog -logname $eventlogname -EntryType $logseverity -ComputerName $computernameeventlog -Newest $lognumber -ErrorAction SilentlyContinue 
}

这将产生一个脚本块，它不会执行，而是作为字符串输出。你想要的是删除括号。

Answer 2

如果您要解决Micky提到的各种支架问题，您的Catch块仍然无法运行。在Try块中，您必须强制终止错误。你强迫它完全忽略错误：

#Note the changed error action:
Get-EventLog -logname $eventlogname -EntryType $logseverity -Newest $lognumber -ErrorAction Stop

#Get some help on the topic:
Get-Help about_Try_Catch_Finally

进一步阅读可能有所帮助：

about_Try_Catch_Finally
PowerShell.org eBooks - PowerShell错误处理大书
An Introduction to Error Handling in PowerShell

最后，暂时不要考虑更易读的格式。一些流行的选择：

Try
{
    #Do something
}
Catch 
{
    #Catch
}

Try {
    #Do something
}
Catch {
    #Catch
}

许多人对这些和其他习俗有强烈的感情，但只要你保持一致，你应该是好的。我看到了第一个例子，但是有些情况下你缩进第一个花括号而不是用关键字排列。

干杯！

Try / Catch块实际上并不执行get-eventlog cmdlet

2 个答案: