Question

我有一个eventlog条目，wouidl喜欢查询“Security UserID”来检索它的值。这可能吗？最好使用powershell

Log Name:      Application
Source:        EventCreate
Date:          26/08/2014 10:17:21
Event ID:      4
Task Category: None
Level:         Information
Keywords:      Classic
User:          DOMAIN\UserName
Computer:      COMPUTERNAME
Description:
This is a test
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventCreate" />
    <EventID Qualifiers="0">4</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-08-26T09:17:21.000000000Z" />
    <EventRecordID>570080</EventRecordID>
    <Channel>Application</Channel>
    <Computer>COMPUTERNAME</Computer>
    <Security UserID="S-1-5-21-xxxxxxxxxxxxxxxxxxxxxx" />
  </System>
  <EventData>
    <Data>Process Started</Data>
  </EventData>
</Event>

Answer 1

可能有更好的方法来做到这一点。但这对我有用，因为我有来自其他来源的EventRecordID。如果有人有更好的方法请发布。

$query = @"
<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[(EventRecordID=570080)]]</Select>
  </Query>
</QueryList>
"@

$evt1 = [xml](Get-WinEvent -FilterXml $query ).toXML()
$evt1.event.System.Security

Answer 2

(Get-WinEvent -LogName 'Application' | Select -First 1).UserId.Value

提前查询Windows事件日志

2 个答案: