powershell监视文件夹和日志更改到Windows应用程序日志

时间:2016-11-24 15:32:22

标签: windows powershell event-log file-watcher

作为描述,我需要编写一个监视文件夹的powershell脚本。当进行了更改(创建文件,删除,修改)时,我需要进行这些更改才能访问Windows应用程序日志。

这是我的代码:

$watcher = New-Object System.IO.FileSystemWatcher
$watcher.Path = "C:\Users\Administrator\Desktop\delete-file-event"
$watcher.Filter = "*.*"
$watcher.IncludeSubdirectories = $true
$watcher.EnableRaisingEvents = $true  


$action = { 
            New-EventLog -LogName Application -source "logs"
            Write-EventLog -LogName Application -Source "logs" -EntryType Information -EventId 1 -Message "nothing in here"
            $path = $Event.SourceEventArgs.FullPath
            $changeType = $Event.SourceEventArgs.ChangeType
            $logline = "$(Get-Date), $changeType, $path"
            Add-content "C:\Users\Administrator\Desktop\delete-file-event\log.txt" -value $logline
          }    

Register-ObjectEvent $watcher "Created" -Action $action
Register-ObjectEvent $watcher "Deleted" -Action $action
Register-ObjectEvent $watcher "Renamed" -Action $action
while ($true) {sleep 5}

此时它会到达应用程序日志但是因为 代码:

New-EventLog -LogName Application -source "logs"
Write-EventLog -LogName Application -Source "logs" -EntryType Information -EventId 1 -Message "nothing in here"

我真的很感激这里的一些帮助。提前谢谢。

0 个答案:

没有答案