CODEWITHSUNDEEP
xmlwindowspowershellevent-log
MalySzaryCzlowiek
MalySzaryCzlowiek

Reputation: 41

Powershell - Getting advanced eventlog informations (xml?)

I need to read specific informatiosn from eventlog. For example - Security log, ID 4648. With simple "Get-Eventlog" i can't get informations like TargetUserName or TargetDomainName in easy way - only from .message value, but it's way harder to read one/two informations from full text. Can i read this from XML eventlog, without exporting log to file?

XML eventlog

Upvotes: 0

Views: 10079

Answers (3)

Theo
Theo

Reputation: 61068

Using the Get-WinEvent cmdlet, you can grab the XML Event data and create your output from there.

Below code does exactly that and returns an array of PsCustomObjects with all event properties found.

$result = Get-WinEvent -FilterHashtable @{LogName="Security";Id=4648} -MaxEvents 100 | ForEach-Object {
    # convert the event to XML and grab the Event node
    $eventXml = ([xml]$_.ToXml()).Event
    # create an ordered hashtable object to collect all data
    # add some information from the xml 'System' node first
    $evt = [ordered]@{
        EventDate = [DateTime]$eventXml.System.TimeCreated.SystemTime
        Computer  = $eventXml.System.Computer
    }
    $eventXml.EventData.ChildNodes | ForEach-Object { $evt[$_.Name] = $_.'#text' }
    # output as PsCustomObject. This ensures the $result array can be written to CSV easily
    [PsCustomObject]$evt
}

# output to screen
$result

# output to CSV file
$result | Export-Csv D:\test.csv -NoTypeInformation

Upvotes: 3

Matthew
Matthew

Reputation: 1450

I would recommend using as described here: https://devblogs.microsoft.com/scripting/data-mine-the-windows-event-log-by-using-powershell-and-xml/

and here: https://blogs.technet.microsoft.com/ashleymcglone/2013/08/28/powershell-get-winevent-xml-madness-getting-details-from-event-logs/

Which go into detail to achieve what you're looking for, additionally you can look further into the Get-EventLog cmdtlet: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1

Upvotes: 1

Dominique
Dominique

Reputation: 17493

PowerShell has a commamnd "Get-EventLog", which is described in this URL: "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1"

Upvotes: 0

Related Questions