Write Specific Events to File

I have a script that captures event properties for the following event ID's: 560,562,567,577,578. I need to know how to output this to a CSV file.

Also, is there a way to append ONLY previously unwritten items? For example: If I write the all the entries on the first day, and then how would I append the new items that have occurred since then?

Below is the code.

#Connect to Remote Computer Event Log.
$logs = [System.Diagnostics.EventLog]::GetEventLogs(RemotePC)

# Connect to Security Log
$colItems = $logs |? {$_.log -eq 'Security'}
$entries = $colItems.Entries

#Filter for these events
$events = @(560,562,567,577,578) 

foreach ($item in $entries){
if ( $events -contains $item.EventID ){

#Write/Format Data on One Line
$item.MachineName + " " + $item.EventID + " " +  $item.TimeWritten + " " + $item.Category + " " + $item.EntryType + " " + $item.UserName + " " + $item.Data + " " + $item.Source + " " + $item.TimeGenerated

Open in new window

Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

Chris DentConnect With a Mentor PowerShell DeveloperCommented:

You don't want to upgrade to PowerShell 2 (downlevel installer is here: http://support.microsoft.com/kb/968929)?

I ask because the Get-EventLog CmdLet received a bit of an overhaul and would, perhaps, be better suited (or at least simpler). I mention this because I would be inclined to use it's "-After" parameter to only full relevant logs rather than having to go back checking each existing entry.

Anyway, that would potentially reduce the first part of the script to:

Get-EventLog Security -Computer RemotePC -InstanceId 560, 562, 567, 577, 578

Getting that to a CSV file can be done with:

Get-EventLog Security -Computer RemotePC -InstanceId 560, 562, 567, 577, 578 | Export-CSV "SomeFile.csv"

If you don't want to shift from what you have now, you may find you can make this modification to your original:

$Entries | ?{ $Events -Contains $_.EventID } | Export-CSV "SomeFile.csv"

This may come apart a bit when it comes to appending lines to the existing file because Export-CSV simply cannot append. One possible solution to that is for you to re-import the existing CSV, append the new entries onto the import, then export again.


$OldEntries = Import-CSV "SomeFile.csv"
$OldEntries += $Entries | ?{ $Events -Contains $_.EventID }
$OldEntries | Export-CSV "SomeFile.csv"

I still advise you use some kind of date time filtering rather than attempt to check every previous entry. Any thoughts?

JB4375Author Commented:
Hey Chris,
The answer is:
A. I was just sent to a Powershell training class despite wanting to wait a few months until the 2.0 class was available.
B. Having issues getting the necessary patches to load on my PC and not wanting to do a complete overhaul due to the amount of software I have installed.
C. All of the above.
Answer: C
I'm going to give it another shot. I'm quickly realizing the 2.0 has to many of these overhauls to miss out on. Also, the date filtering sounds like it has some potential.
I'm either going to do that, or run the script every 24 hours and incorporate the date into the name of the file. Then they can worry with going over the data.
I may come back up with another question later but this will give me something to go on.
JB4375Author Commented:
Thanks Chris... great assist as always!!
Chris DentPowerShell DeveloperCommented:

Get-EventLog isn't all that much more efficient (operationally) than the method you're using above, it's really just something for simplicity. If you want to stick with this and add in some date filtering I'll happily help you finish it off :)

If you go for date filtering, you might import the last file, then use the last date from that to act as a starting point for filter the next.

All Courses

From novice to tech pro — start learning today.