PowerShell - Discover 7 Days Events to csv
- Jon Boyette
- Jan 11, 2022
- 1 min read
This Script I just copy and paste as needed with server/computer name added, the output csv is rather generic but gives good clues when event logs are large. Helps in the troubleshooting re-occurring issues that would be found in events, THIS GETS THE LAST 7 DAYS OF SYSTEM AND APPLICATION LOGS TO CSV
Copy and paste entire contents with your server/computer name added
#If Not on a DC run 'Import-Module ActiveDirectory' from a same Domain management box.
#Run on machine wanting to report on, outputs to c:\temp
Set-Variable -Name EventAgeDays -Value 7 #we will take events for the latest 7 days
Set-Variable -Name CompArr -Value @("YOURS") # replace it with your server names <---
Set-Variable -Name LogNames -Value @("Application", "System") # Checking app and system logs
Set-Variable -Name EventTypes -Value @("Error", "Warning") # Loading only Errors and Warnings
Set-Variable -Name ExportFolder -Value "C:\TEMP"
$el_c = @() #consolidated error log
$now=get-date
$startdate=$now.adddays(-$EventAgeDays)
$ExportFile=$ExportFolder + "el" + $now.ToString("yyyy-MM-dd---hh-mm-ss") + ".csv" # we cannot use standard delimiteds like ":"
foreach($comp in $CompArr)
{
foreach($log in $LogNames)
{
Write-Host Processing $comp\$log
$el = get-eventlog -ComputerName $comp -log $log -After $startdate -EntryType $EventTypes
$el_c += $el #consolidating
}
}
$el_sorted = $el_c | Sort-Object TimeGenerated #sort by time
Write-Host Exporting to $ExportFile
$el_sorted|Select EntryType, TimeGenerated, Source, EventID, MachineName | Export-CSV $ExportFile -NoTypeInfo #EXPORT
Write-Host Done!
Comments