Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Powershell Export Event logs

Posted on 2015-02-06
3
Medium Priority
?
328 Views
Last Modified: 2015-02-21
Not sure what I am doing wrong I am trying to get all the different types of logs into a file with server name.  The File path is not coming out correctly.


The function I am user is here
http://www.insidepowershell.com/?p=611



# Import Testing function (also defines prerequisites)
. C:\NOCScripts\Powershell\GetLogData\Export-EventLog.ps1

$Servers = get-content "C:\NOCScripts\Powershell\GetLogData\splunk\ServerList.txt"
$LogDest = "C:\NOCScripts\Powershell\GetLogData\splunk\evxt"

$LogNamesArry = "Application,Hardware Events,Operations Manager,Security,System,Windows Powershell,Internet Explorer,Key Management Service"
$LogNames = $LogNamesArry.split(',');

$Days_Ago = 1096


FOREACH ($Server in $Servers){
            FOREACH($LogName in $LogNames){
            Write-Host $LogName $Server $Start_Date
             
Write-Host $Server $LogName 
 Export-EventLog -Servers $Server -Logname $LogName -FileName "$Server.evtx" -Path  $LogDest -Days $Days_Ago

        }

}

Open in new window



Output Produced with error
Hardware Events n2sup2is02 

 Export Started 
 Server: n2sup2is02 
 Path:  C:\NOCScripts\Powershell\GetLogData\splunk\evxt\\HardwareEvents n2sup2is02 2015-02-06.evtx 
 Days: 1096 

wevtutil : Failed to export log Hardware Events. The specified channel could not be found. Check channel configuration.
At C:\NOCScripts\Powershell\GetLogData\Export-EventLog.ps1:126 char:1
+ wevtutil epl $logname "$path\$filename" /ow /r:"$server" /q:"*[System[TimeCreate ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (Failed to expor... configuration.:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
 

 Export Complete: C:\NOCScripts\Powershell\GetLogData\splunk\evxt\\HardwareEvents n2sup2is02 2015-02-06.evtx 

Open in new window

0
Comment
Question by:Leo Torres
  • 2
3 Comments
 
LVL 41

Expert Comment

by:footech
ID: 40595507
Your output for the path does not match with the code posted, so something is definitely different than above.  Running the code above with a servername of "localhost", I get a path like
Path:  C:\NOCScripts\Powershell\GetLogData\splunk\evxt\localhos localhost 2015-02-07.evtx
Yes, it says "localhos" at one point because of the way the Trim method works - better would be to use the Replace method so you don't get unexpected results.

As far as the error message, it's because the channel is "HardwareEvents" without a space, so you need to modify line 7 where you define $LogNamesArry.
0
 
LVL 8

Author Comment

by:Leo Torres
ID: 40596515
The path Name yes is one of my issues not sure why I get that bad path.

Any idea on path issue.
0
 
LVL 41

Accepted Solution

by:
footech earned 2000 total points
ID: 40597382
As you can see from the result I posted, there was no problem with the path.

To try to diagnose any issue you're having with the path I would need the command you're running, any file that supplies input, and the output.  As I mentioned, the sample output you provided before does not match with the code as shown, so you must have changed something.
0

Featured Post

Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Previously, on our Nano Server Deployment series, we've created a new nano server image and deployed it on a physical server in part 2. Now we will go through configuration.
A walk-through example of how to obtain and apply new DID phone numbers to your cloud PBX enabled users that are configured in Office 365. Whether you have 1, 10 or 100+ users in your tenant, it's quite easy to get them phone-enabled and making/rece…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an anti-spam), the admin…

963 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question