CODEWITHSUNDEEP
powershelllogging
Dpitt1968
Dpitt1968

Reputation: 109

Powershell, command line and event logs

We added the following to the powershell profile in an effort to collect what's typed in the command line. 

$LogCommandHealthEvent = $true
$LogCommandLifeCycleEvent = $true

But how do I get the info from here, I'm looking for what's typed in the command line into the powershell console - 

$event = Get-WinEvent -FilterHashtable @{logname=’Windows Powershell'; id=500} -MaxEvents 1
$Event.Message

gives me the info but all I want is the last line "CommandLine" 

Details: 
    NewCommandState=Started

    SequenceNumber=313

    HostName=Windows PowerShell ISE Host
    HostVersion=4.0
    HostId=6fda55e7-4366-4719-ad59-8962eda1521f
    EngineVersion=4.0
    RunspaceId=e82c8130-1c67-4d61-b513-9ac55bc148ba
    PipelineId=52
    CommandName=Get-WinEvent
    CommandType=Cmdlet
    ScriptName=
    CommandPath=
    CommandLine=$event = Get-WinEvent -FilterHashtable @{logname=’Windows Powershell'; id=500} -MaxEvents 1

Any suggestions?

Upvotes: 0

Views: 494

Answers (1)

Mathias R. Jessen
Mathias R. Jessen

Reputation: 174445

The Message property is one multi-line string, I would split it by newlines and select the last one:

$Event.Message -split "`r?`n" |Select-Object -Last 1

Upvotes: 1

Related Questions