Solved

Powershell script to export EVents logs in human readable

Posted on 2013-10-30
7
1,142 Views
Last Modified: 2013-11-02
Hi experts,

     I want a Power shell script to export event logs in below format. Please help somebody. I am very new to scripting.
AccountName	AccountDomain	Message			EventID	TimeCreated
John		Testserver	Workstation was locked	4800	10.30.2013 18:45

Open in new window

0
Comment
Question by:srsysdoc
  • 3
  • 2
7 Comments
 
LVL 24

Expert Comment

by:Coralon
ID: 39615762
The domain isn't easy to extract... I'm having to give that some thought.. but the basics are pretty easy..

get-eventlog -logname <name> | select-object -property UserName,Message,EventID,TimeGenerated

Open in new window


That gives you the basics.. doesn't include column headers.  If you need those, I can add more later.. :-)

Coralon
0
 
LVL 68

Accepted Solution

by:
Qlemo earned 500 total points
ID: 39616884
In future please provide more details (like "using the Security Event Log"), that makes it much easier to get reasonable responses. I reckon from event ID 4800 that you want to read that log.

What Coralon suggested won't work - it isn't that easy at all. Account data is included in the message body, and not available as (isolated) property. Parsing is depending on the message, so specific parsing only works with specific event IDs, and we will have to filter for those IDs or apply different parsing filters for different IDs.

You will also want to restrict the time span, similar to what has been posted in http://www.experts-exchange.com/Q_27711800.html .

My suggestion is to use:
$filedate = get-date -uformat "%m-%d-%Y"
$yesterday = (get-date) - (new-timespan -day 1)

Get-EventLog Security -After $yesterday <# -InstanceID 4800, 4801 #> |
  Select @{n='AccountName'   ; e={ if ($_.message -match '(?:Account Name|Logon Account):\s*(.+)\s*\r'  ) {$matches[1]} }},
         @{n='AccountDomain' ; e={ if ($_.message -match 'Account Domain:\s*(.+)\s*\r') {$matches[1]} }},
         @{n='Message'       ; e={ $_.message.Split("`r`n")[0] } },
         EventID,
         TimeGenerated |
  Export-Csv -NoTypeInformation Activity_$filedate.csv

Open in new window

You might want to restrict to specific event IDs. An example is included as comment.
0
 
LVL 24

Expert Comment

by:Coralon
ID: 39618401
Actually, what I put up did exactly what he asked, other than the one column.  I had tested it before posting it just to be sure.  

He didn't ask for a specific event, or a specific timeline, or even a specific log.

Coralon
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 68

Expert Comment

by:Qlemo
ID: 39618725
Coralon,

My comment makes more sense if seen in context of the other question I referred to (and the Asker posted in). But you should have seen that "UserName" doesn't make ANY sense in context of this question, as it is empty all the time. Also, EventID 4800 is well-known to be in the Security log.
0
 

Author Comment

by:srsysdoc
ID: 39619506
Hi Coralon,

        Thanks for spending your valuable time on my question. Your script also working fine but it didn't show me the username.
0
 
LVL 24

Expert Comment

by:Coralon
ID: 39619513
It showed the username from the event itself -- the account that was running the item that triggered the event.    It is definitely a different thing then looking for the account in the text of the event :-)  I'm glad Qlemo was able to get you those details.

As a matter of course, please be specific at what you want, don't leave it to us to guess :-)  Some of us will guess wrong, lol.
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Issue: One Windows 2008 R2 64bit server on the network unable to connect to a buffalo Device (Linkstation) with firmware version 1.56. There are a total of four servers on the network this being one of them. Troubleshooting Steps: Connect via h…
Know what services you can and cannot, should and should not combine on your server.
This tutorial will give a short introduction and overview of Backup Exec 2012 and how to navigate and perform basic functions. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as conne…
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now