Write Specific Events to File

Posted on 2010-01-05
Last Modified: 2012-05-08
I have a script that captures event properties for the following event ID's: 560,562,567,577,578. I need to know how to output this to a CSV file.

Also, is there a way to append ONLY previously unwritten items? For example: If I write the all the entries on the first day, and then how would I append the new items that have occurred since then?

Below is the code.

#Connect to Remote Computer Event Log.

$logs = [System.Diagnostics.EventLog]::GetEventLogs(RemotePC)

# Connect to Security Log

$colItems = $logs |? {$_.log -eq 'Security'}

$entries = $colItems.Entries

#Filter for these events

$events = @(560,562,567,577,578) 

foreach ($item in $entries){

if ( $events -contains $item.EventID ){

#Write/Format Data on One Line

$item.MachineName + " " + $item.EventID + " " +  $item.TimeWritten + " " + $item.Category + " " + $item.EntryType + " " + $item.UserName + " " + $item.Data + " " + $item.Source + " " + $item.TimeGenerated




Open in new window

Question by:JB4375
    LVL 70

    Accepted Solution


    You don't want to upgrade to PowerShell 2 (downlevel installer is here:

    I ask because the Get-EventLog CmdLet received a bit of an overhaul and would, perhaps, be better suited (or at least simpler). I mention this because I would be inclined to use it's "-After" parameter to only full relevant logs rather than having to go back checking each existing entry.

    Anyway, that would potentially reduce the first part of the script to:

    Get-EventLog Security -Computer RemotePC -InstanceId 560, 562, 567, 577, 578

    Getting that to a CSV file can be done with:

    Get-EventLog Security -Computer RemotePC -InstanceId 560, 562, 567, 577, 578 | Export-CSV "SomeFile.csv"

    If you don't want to shift from what you have now, you may find you can make this modification to your original:

    $Entries | ?{ $Events -Contains $_.EventID } | Export-CSV "SomeFile.csv"

    This may come apart a bit when it comes to appending lines to the existing file because Export-CSV simply cannot append. One possible solution to that is for you to re-import the existing CSV, append the new entries onto the import, then export again.


    $OldEntries = Import-CSV "SomeFile.csv"
    $OldEntries += $Entries | ?{ $Events -Contains $_.EventID }
    $OldEntries | Export-CSV "SomeFile.csv"

    I still advise you use some kind of date time filtering rather than attempt to check every previous entry. Any thoughts?

    LVL 1

    Author Comment

    Hey Chris,
    The answer is:
    A. I was just sent to a Powershell training class despite wanting to wait a few months until the 2.0 class was available.
    B. Having issues getting the necessary patches to load on my PC and not wanting to do a complete overhaul due to the amount of software I have installed.
    C. All of the above.
    Answer: C
    I'm going to give it another shot. I'm quickly realizing the 2.0 has to many of these overhauls to miss out on. Also, the date filtering sounds like it has some potential.
    I'm either going to do that, or run the script every 24 hours and incorporate the date into the name of the file. Then they can worry with going over the data.
    I may come back up with another question later but this will give me something to go on.
    LVL 1

    Author Closing Comment

    Thanks Chris... great assist as always!!
    LVL 70

    Expert Comment

    by:Chris Dent

    Get-EventLog isn't all that much more efficient (operationally) than the method you're using above, it's really just something for simplicity. If you want to stick with this and add in some date filtering I'll happily help you finish it off :)

    If you go for date filtering, you might import the last file, then use the last date from that to act as a starting point for filter the next.


    Featured Post

    Threat Intelligence Starter Resources

    Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

    Join & Write a Comment

    In this previous article (, we made basic license assignments to users in O365. When I say basic, the method is the simplest way …
    "Migrate" an SMTP relay receive connector to a new server using info from an old server.
    Internet Business Fax to Email Made Easy - With eFax Corporate (, you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
    Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…

    755 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    19 Experts available now in Live!

    Get 1:1 Help Now