CODEWITHSUNDEEP
powershell
SQLGooner
SQLGooner

Reputation: 31

Remote query of multiple servers using Get-EventLog in PowerShell

I am writing a PowerShell script for my morning routine. I want to pull only the Warnings and Errors from a list of remote servers. Currently I am only getting either Warnings or Errors. I am not certain how to retrieve both. Once I pull the info, it doesn't include the server. My query is below:

# SERVER LIST PROPERTIES
# Get computer list to check disk space. This is just a plain text file with the servers listed out.
 $computers = Get-Content "C:\MorningChecks.txt"; 

# QUERY COMPUTER SYSTEM EVENT LOG
foreach($computer in $computers)
{
 Get-EventLog -LogName System -EntryType Error -After (Get-Date).Adddays(-1) | Format-Table -Wrap ;
}

Upvotes: 3

Views: 19424

Answers (1)

HAL9256
HAL9256

Reputation: 13453

The -EntryType Parameter accepts an array of strings for the filtering.

So to filter only for Errors you would use the parameter:

Get-EventLog -LogName System -EntryType Error -After (Get-Date).Adddays(-1)

To filter for Errors and Warnings:

Get-EventLog -LogName System -EntryType "Error","Warning" -After (Get-Date).Adddays(-1)

To get the computer name, you have to add it to the -Property parameter on the end of the Format-Table:

Format-Table -Wrap -Property MachineName, Index, TimeGenerated, EntryType, Source, InstanceID, Message -AutoSize

-- Edit

To answer your question on the machine name showing your own machine, it's because when you run Get-EventLog you are just running it for your local machine. You forgot to specify the -ComputerName parameter in your foreach loop. Your foreach loop should look like:

foreach($computer in $computers)
{
 Get-EventLog -ComputerName $computer -LogName System -EntryType "Error","Warning" -After (Get-Date).Adddays(-1) | Format-Table -Wrap -Property MachineName, Index, TimeGenerated, EntryType, Source, InstanceID, Message -AutoSize ;
}

Upvotes: 2

Related Questions