Question

The following command for a Get-WinEvent command works:

PowerShell:

Get-WinEvent -FilterHashtable @{Logname=’application’;StartTime="2018-04-20 00:00:00";EndTime="2018-04-20 23:59:59"}

CMD:

powershell.exe -noprofile -command "Get-WinEvent -FilterHashtable @{Logname=\"application\";StartTime=\"2018-04-18 17:42:56\";EndTime=\"2018-04-19 17:43:01\"}"

The problem I'm facing is that when I try to pipe the results to get a specific RecordID, it works in PowerShell:

Get-WinEvent -FilterHashtable @{Logname=’application’;StartTime="2018-04-20 00:00:00";EndTime="2018-04-20 23:59:59"} | ? {$_.RecordId -eq 293116} | Select Message

When I try to add the same thing to my cmd call, it returns no results:

powershell.exe -noprofile -command "Get-WinEvent -FilterHashtable @{Logname=\"application\";StartTime=\"2018-04-18 17:42:56\";EndTime=\"2018-04-19 17:43:01\"} | ? {$RecordId -eq 293116} | Select Message"

I've already tried replacing the ? with Where-Object and -property to rule out an issue with CMD characters being misinterpreted. I feel like I'm missing something obvious here.

Answer 1

不是转义所有内部双引号，而是使用单引号：

powershell.exe -nop -c "Get-WinEvent -FilterHashtable @{Logname=’application’;StartTime=’2018-04-18 17:42:56’;EndTime=’2018-04-19 17:43:01’} | ? {$RecordId -eq 293116} | Select Message"

除了这里不存在的RecordId，它还可以。

Answer 2

我能够解决这个问题。

因为我从SQL到CMD再到PowerShell，所以有一些字符被解释为我没想到的方式并且没有返回任何消息。最后，我能够编写这个存储过程，它将使用xp_cmdshell从SQL主机调用特定的机器，它将为您提供特定时间范围内的事件查看器日志。

我还对一些记录进行了覆盖，以避免它长时间运行。这是存储过程的内容：

        if object_id('tempdb..#result') IS NOT NULL
        drop table #result
    create table #result
        ([ID] int
        ,[Timegenerated] datetime
        ,[EntryType] varchar(max)
        ,[Source] varchar(max)
        ,[Message] nvarchar(max)
        )

    if object_id('tempdb..#temp') IS NOT NULL
        drop table #temp
    create table #temp
        ([output] nvarchar(max))

    Declare @command nvarchar(1000)
    Set @command = 'powershell.exe -noprofile -command "Get-WinEvent -FilterHashtable @{Logname=''application'';StartTime='''+@StartTime+''';EndTime='''+@EndTime+'''} -MaxEvents ' + @topEvents + '| % {\"$($_.RecordId)`t$($_.TimeCreated)`t$($_.ProviderName)`t$($_.LevelDisplayName)\"}"'

    Insert Into #temp
        exec xp_cmdshell @command

    Delete from #temp where [output] is null

    Declare @fullstring nvarchar(max)
    While (Select COUNT(*) from #temp) > 0
    BEGIN
        Select TOP 1 @fullstring = [output] from #temp
        Insert Into #result
        SELECT TOP 1 dbo.F_ExtractSubString([output], 1, '    ') AS ID,
                dbo.F_ExtractSubString([output], 2, '    ') AS TimeGenerated,
                dbo.F_ExtractSubString([output], 3, '    ') AS EntryType,
                dbo.F_ExtractSubString([output], 4, '    ') AS Source,
                Null
        FROM   #temp
        Delete From #temp where [output] = @fullstring
    END

    Declare @IDSearch nvarchar(100), @messageString NVARCHAR(MAX)
    While (Select COUNT(*) from #result Where #result.[Message] is null) > 0
    BEGIN
        Select Top 1 @IDSearch = ID from #result Where #result.[Message] is null

        Set @command = 'powershell.exe -noprofile -command "Get-WinEvent -FilterHashtable @{Logname=''application'';StartTime='''+@StartTime+''';EndTime='''+@EndTime+'''} | ? {$_.RecordId -eq ' + @IDSearch + '} | % {\"$($_.Message)`r`n\"}'

        Insert Into #temp
            exec xp_cmdshell @command

        Set @messageString = STUFF(
                            (   SELECT ',' + CONVERT(NVARCHAR(Max), [output])
                                FROM #temp
                                FOR xml path('')
                            )
                            , 1
                            , 1
                            , '')

        Update #result Set [Message] = @messageString Where ID = @IDSearch

        TRUNCATE TABLE #temp
    END

    Select * from #result

PowerShell vs CMD same command having different results

2 个答案: