如何从上一个事件ID

时间:2016-12-27 02:02:14

标签: powershell event-log

我有一个脚本,它是第一次从多个远程服务器获取事件日志。第二次它应该检查它不是我为每个远程服务器首先获取的eventID,或者它应该是更大的上一个eventID。每次它都不应该获取相同的事件日志。

我怎样才能做到这一点。任何建议都会有所帮助

剧本:

#Give your local path on where you are saving server.txt file
$ComputerList = "E:\Event\servers.txt"

#Script Vaiables

$Computers = Get-Content $ComputerList | Where-Object { $_ }
$WindowslogName = "Application"
$WindowsMessageMatch = "Event 'Task Stopped'"
$TodaysDate = Get-Date
$TodaysDate.ToUniversalTime()

$AfterDate=Get-Date
$AfterDate.AddDays(-1)
$AfterDate.ToUniversalTime()

#Query Event Log
foreach($Computer in $Computers)
{
       Write-Host "Fetching Event Logs $Computer"
       $Event=Get-Eventlog -After $AfterDate  -Before $TodaysDate -LogName Application -ErrorAction SilentlyContinue -InstanceId 602 -Message "*Event 'Task Stopped'*" -Newest 1 -ComputerName $Computer
       $Event|Format-List * 
}

0 个答案:

没有答案