Solved

Powershell Export Event logs

Posted on 2015-02-06
3
237 Views
Last Modified: 2015-02-21
Not sure what I am doing wrong I am trying to get all the different types of logs into a file with server name.  The File path is not coming out correctly.


The function I am user is here
http://www.insidepowershell.com/?p=611



# Import Testing function (also defines prerequisites)
. C:\NOCScripts\Powershell\GetLogData\Export-EventLog.ps1

$Servers = get-content "C:\NOCScripts\Powershell\GetLogData\splunk\ServerList.txt"
$LogDest = "C:\NOCScripts\Powershell\GetLogData\splunk\evxt"

$LogNamesArry = "Application,Hardware Events,Operations Manager,Security,System,Windows Powershell,Internet Explorer,Key Management Service"
$LogNames = $LogNamesArry.split(',');

$Days_Ago = 1096


FOREACH ($Server in $Servers){
            FOREACH($LogName in $LogNames){
            Write-Host $LogName $Server $Start_Date
             
Write-Host $Server $LogName 
 Export-EventLog -Servers $Server -Logname $LogName -FileName "$Server.evtx" -Path  $LogDest -Days $Days_Ago

        }

}

Open in new window



Output Produced with error
Hardware Events n2sup2is02 

 Export Started 
 Server: n2sup2is02 
 Path:  C:\NOCScripts\Powershell\GetLogData\splunk\evxt\\HardwareEvents n2sup2is02 2015-02-06.evtx 
 Days: 1096 

wevtutil : Failed to export log Hardware Events. The specified channel could not be found. Check channel configuration.
At C:\NOCScripts\Powershell\GetLogData\Export-EventLog.ps1:126 char:1
+ wevtutil epl $logname "$path\$filename" /ow /r:"$server" /q:"*[System[TimeCreate ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (Failed to expor... configuration.:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
 

 Export Complete: C:\NOCScripts\Powershell\GetLogData\splunk\evxt\\HardwareEvents n2sup2is02 2015-02-06.evtx 

Open in new window

0
Comment
Question by:Leo Torres
  • 2
3 Comments
 
LVL 39

Expert Comment

by:footech
Comment Utility
Your output for the path does not match with the code posted, so something is definitely different than above.  Running the code above with a servername of "localhost", I get a path like
Path:  C:\NOCScripts\Powershell\GetLogData\splunk\evxt\localhos localhost 2015-02-07.evtx
Yes, it says "localhos" at one point because of the way the Trim method works - better would be to use the Replace method so you don't get unexpected results.

As far as the error message, it's because the channel is "HardwareEvents" without a space, so you need to modify line 7 where you define $LogNamesArry.
0
 
LVL 8

Author Comment

by:Leo Torres
Comment Utility
The path Name yes is one of my issues not sure why I get that bad path.

Any idea on path issue.
0
 
LVL 39

Accepted Solution

by:
footech earned 500 total points
Comment Utility
As you can see from the result I posted, there was no problem with the path.

To try to diagnose any issue you're having with the path I would need the command you're running, any file that supplies input, and the output.  As I mentioned, the sample output you provided before does not match with the code as shown, so you must have changed something.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Entity Framework is a powerful tool to help you interact with the DataBase but still doesn't help much when we have a Stored Procedure that returns more than one resultset. The solution takes some of out-of-the-box thinking; read on!
How to sign a powershell script so you can prevent tampering, and only allow users to run authorised Powershell scripts
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now