Powershell小技巧之从文件获取系统日志
有时你可能会需要分析系统文件将他们传输到硬盘，或你想直接从“evtx”读取系统日志。
你可以这样做：
$path="$env:windir\System32\Winevt\Logs\Setup.evtx" Get-WinEvent-Path$path
另附上一段获取系统日志的代码
$StartTime=(get-date).Date+(new-timespan-Hours6-Minutes35)
$EndTime=(get-date).Date+(new-timespan-Hours6-Minutes36)
$global:TaskStart
$Global:TaskComplete
$Global:events
$Global:event
$Global:TimeSpent
$Global:events=get-winevent-FilterHashtable@{logname="Microsoft-Windows-TaskScheduler/Operational";ID=107;StartTime=$StartTime;EndTime=$EndTime}
Foreach($Global:eventin$Global:events)
{
cls
$StartLogs=get-winevent-FilterHashtable@{logname="Microsoft-Windows-TaskScheduler/Operational";ID=100;StartTime=$StartTime}
$CompleteLogs=get-winevent-FilterHashtable@{logname="Microsoft-Windows-TaskScheduler/Operational";id=102;StartTime=$StartTime}
$global:TaskStart=$StartLogs|where{$_.ActivityId-eq$Global:event.ActivityId}
$Global:TaskComplete=$CompleteLogs|where{$_.ActivityId-eq$Global:event.ActivityId}
$global:TimeSpent=($global:TaskComplete.timeCreated-$global:TaskStart.timeCreated).TotaLMinutes
if(($global:TaskStart-ne$NULL)-and($Global:TaskComplete-ne$null)-and($Global:TimeSpent-gt1)){
$Messagebody="Synctaskstartedat: "+$global:TaskStart.TimeCreated.DateTime+"`r`n"
$Messagebody=$Messagebody+"`r`nSynctaskcompletedat: "+$global:TaskComplete.timeCreated.DateTime+"`r`n"
$Messagebody=$Messagebody+"`r`nTasklastedfor"+("{0:N2}"-f($Global:TimeSpent))+"minutes"
Send-MailMessage-From"CustomerLog@avepoint.com"-To"Zhijie.bai@avepoint.com","Infrastructure_cn@avepoint.com"-Subject"CustomerLogsSyncReport:Success"-Body$Messagebody-SmtpServer"10.100.100.153"-EncodingUTF8
}
else{
$Messagebody="########################################################################`r`n"
$Messagebody=$Messagebody+"`r`nCustomlogsSyncfailed,pleaselogin10.2.0.125tocheckandsyncagain`r`n"
$Messagebody=$Messagebody+"`r`n########################################################################`r`n"
Send-MailMessage-From"CustomerLog@avepoint.com"-To"Zhijie.bai@avepoint.com","Infrastructure_cn@avepoint.com"-Subject"CustomerLogsSyncReport:Failed"-Body$Messagebody-SmtpServer"10.100.100.153"-EncodingUTF8-PriorityHigh
}
}
支持Powershell所有版本