-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathDRMM-EventLogSearch.ps1
44 lines (39 loc) · 1.27 KB
/
DRMM-EventLogSearch.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
$detect = $env:Detect
$interval = $env:Interval
$time = $env:Time
$LogName = $env:LogName
$EventID = $env:EventID
$EventType = $env:EventType
$Comment = $env:Comment
switch ($interval) {
"seconds" {$date = (Get-Date).addseconds(-$time)}
"minutes" {$date = (Get-Date).addminutes(-$time)}
"hours" {$date = (Get-Date).addhours(-$time)}
"days" {$date = (Get-Date).adddays(-$time)}
}
write-host (Get-Date) -ForegroundColor Green
write-host "Checking $LogName for EventID $EventID since $date..." -ForegroundColor Green
$search = Get-EventLog -LogName $LogName -After $date -EntryType $EventType | Where-Object {$_.EventId -eq $EventID}
if ($search) {
if ($comment) {
Write-Host "====== ENGINEER COMMENT ======"
Write-Host $comment
write-host ""
Write-Host "====== DIAGNOSTIC INFO ======"
}
if ($detect -eq "true") {
Write-Host "DETECTED"
}
Write-Host "$env:COMPUTERNAME - Event ID $EventID written to $LogName log within the last $time $interval"
} else {
if ($comment) {
Write-Host "====== ENGINEER COMMENT ======"
Write-Host $comment
write-host ""
Write-Host "====== DIAGNOSTIC INFO ======"
}
if ($detect -eq "false") {
Write-Host "NOT DETECTED"
}
Write-Host "$env:COMPUTERNAME - Event ID $EventID not written in $LogName log within the last $time $interval"
}