top of page

PowerShell - Discover 7 Days Events to csv

  • Writer: Jon Boyette
    Jon Boyette
  • Jan 11, 2022
  • 1 min read

This Script I just copy and paste as needed with server/computer name added, the output csv is rather generic but gives good clues when event logs are large. Helps in the troubleshooting re-occurring issues that would be found in events, THIS GETS THE LAST 7 DAYS OF SYSTEM AND APPLICATION LOGS TO CSV

Copy and paste entire contents with your server/computer name added

#If Not on a DC run 'Import-Module ActiveDirectory' from a same Domain management box.

#Run on machine wanting to report on, outputs to c:\temp

Set-Variable -Name EventAgeDays -Value 7 #we will take events for the latest 7 days

Set-Variable -Name CompArr -Value @("YOURS") # replace it with your server names <---

Set-Variable -Name LogNames -Value @("Application", "System") # Checking app and system logs

Set-Variable -Name EventTypes -Value @("Error", "Warning") # Loading only Errors and Warnings

Set-Variable -Name ExportFolder -Value "C:\TEMP"

$el_c = @() #consolidated error log

$now=get-date

$startdate=$now.adddays(-$EventAgeDays)

$ExportFile=$ExportFolder + "el" + $now.ToString("yyyy-MM-dd---hh-mm-ss") + ".csv" # we cannot use standard delimiteds like ":"

foreach($comp in $CompArr)

{

foreach($log in $LogNames)

{

Write-Host Processing $comp\$log

$el = get-eventlog -ComputerName $comp -log $log -After $startdate -EntryType $EventTypes

$el_c += $el #consolidating

}

}

$el_sorted = $el_c | Sort-Object TimeGenerated #sort by time

Write-Host Exporting to $ExportFile

$el_sorted|Select EntryType, TimeGenerated, Source, EventID, MachineName | Export-CSV $ExportFile -NoTypeInfo #EXPORT

Write-Host Done!


 
 
 

Recent Posts

See All
PowerShell - List All Domain SPNs

Save as same List_ALL_SPNs.ps1 or similar, this LDap calls the Domain for all Service Principal names and accounts related #Build LDAP...

 
 
 
PowerShell - Start-Monitoring

This is a great script used to Monitor and Email if a server is up or down, once ran, and smtp and from address is set, then run:...

 
 
 

Comments


Post: Blog2 Post
  • Facebook
  • Twitter
  • LinkedIn

©2022 by Boyette Technical Services. Proudly created with Wix.com

bottom of page