我有一个脚本,它是第一次从多个远程服务器获取事件日志。第二次它应该检查它不是我为每个远程服务器首先获取的eventID,或者它应该是更大的上一个eventID。每次它都不应该获取相同的事件日志。
我怎样才能做到这一点。任何建议都会有所帮助
剧本:
#Give your local path on where you are saving server.txt file
$ComputerList = "E:\Event\servers.txt"
#Script Vaiables
$Computers = Get-Content $ComputerList | Where-Object { $_ }
$WindowslogName = "Application"
$WindowsMessageMatch = "Event 'Task Stopped'"
$TodaysDate = Get-Date
$TodaysDate.ToUniversalTime()
$AfterDate=Get-Date
$AfterDate.AddDays(-1)
$AfterDate.ToUniversalTime()
#Query Event Log
foreach($Computer in $Computers)
{
Write-Host "Fetching Event Logs $Computer"
$Event=Get-Eventlog -After $AfterDate -Before $TodaysDate -LogName Application -ErrorAction SilentlyContinue -InstanceId 602 -Message "*Event 'Task Stopped'*" -Newest 1 -ComputerName $Computer
$Event|Format-List *
}