Question

我正在尝试列出所有已重复记录的事件

我之前尝试过这个：

Get-EventLog -ListLog * |Where-Object {$_.RecordCount -eq 2}

也

Get-WinEvent -ListLog * |Where-Object {$_.RecordCount -eq 2}

两者都不起作用

Answer 1

首先，我不了解您需要使用哪些日志。我写了这个：

Get-WinEvent -LogName System  | Group-Object Message | Sort-Object Count -Descending | Where-Object {$_.Count -gt 2}| ForEach-Object {
    [PSCustomObject]@{
        NumberOfEvents  = $_.Count
        EventId         = $_.Group[0].Id
        Message         = $_.Name
  }
}

检查系统日志。结果如下：

NumberOfEvents EventId Message                                                                                                                                                       
-------------- ------- -------                                                                                                                                                       
            12      44 Windows Update started downloading an update.                                                                                                                 
             8   10016 The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID ...                           
             8      24 NIC /DEVICE/{2FC7C3F4-BBB9-448E-92DB-A1761FDF2718} (Friendly Name: Microsoft Network Adapter Multiplexor Driver) is no longer operational.                    
             7     158 The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is e...
             7    7040 The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start.                                            
             7    7001 Cannot retrieve event message text.                                                                                                                           
             7    7040 The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start.                                            
             6     521 Active battery count change.                                                                                                                                  
             5     105 Power source change.

干杯，

维克多

列出已重复记录的所有事件

1 个答案: