Get-WinEventEXT/Get-WinEventEXT.ps1 at main · Mihaly7/Get-WinEventEXT · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
Function Get-WinEventEXT
{

# Parameters
        Param
        (
         [Parameter(Mandatory=$true)]
            [string]$Logname = (Read-Host "Logname (* for wildcard)"),
            [string]$Date = (Read-Host  "Start date (format should be MM/DD/YYYY)"),
            [string]$Time = (Read-Host "Start time (HH:MM:SS)"),
            [string]$Duration  = (Read-Host  "Duration (HH:MM:SS)"),


        [Parameter(Mandatory=$false)]
            [string]$Path = (Get-Location).path,
            [string]$Message = $null,
            [array]$EventId = $null,
            [array]$ProviderName = $null,
            [bool]$FilterInformation = $false,
            [bool]$Detailed = $false,
            [bool]$Backwards = $false
        )

# Date and time conversion
$StartTime = $Date+" "+$Time | Get-date
If ($Backwards -ne $false)
    {
    $M = "-"
    }
Else
    {
    $M = $null
    }

#Duration calculator

If ($Duration -like "*:*")
    {
    $CDuration = $Duration.split(':')
    $endTime = ($StartTime).AddSeconds(($m+(new-timespan -hour $CDuration[0] -Minutes $CDuration[1] -Seconds $CDuration[2]).TotalSeconds).tostring())
    }

Else
    {
    $endTime = ($StartTime).Addhours($m+($Duration).tostring())
    }

#$Backward Check

If ($backwards -eq $true)
    {
    $sTime = $endTime
    $eTime = $StartTime
    }
Else
    {
    $sTime = $StartTime
    $eTime = $endTime
    }


# Default event level: Informational included
# Information level filter
$maxlevel = 4

if ($Filterinformation -eq $true)
    {
        [int]$maxlevel = 3
    }

# Gather evtx files

$Evtxfiles = Get-ChildItem -path $path -filter "$LogName*" -Include *.evtx -Recurse


# Read logs

    foreach($Evtxfile in $Evtxfiles)
    {

# Show actual log file

    ((Get-WinEvent -Path $Evtxfile.FullName -MaxEvents 10 ) | Where machinename -ne $null | select Machinename,logname)[0]

    Write-Host "Log location: $Evtxfile `n"


#create Hashtable

$Filter = @{Path=$Evtxfile.FullName;Starttime = $sTime; Endtime = $eTime}

If ($EventId -ne $null)
    {
    $Filter = $Filter+@{ID= $EventID}
    }
If ($ProviderName -ne $null)
    {
    $Filter = $Filter+@{ProviderName= $ProviderName}
    }


# Read log

            $output =  Get-winevent -FilterHashtable $Filter -ErrorAction SilentlyContinue  | where {$_.Level -gt 0 -and $_.Level -le $maxlevel}

# Filter by message

            $output = $output | where message -like "*$message*"

# Write log entries to host

        if ($detailed -ne $false)
            {
            $output | Sort-Object TimeCreated | Format-List Timecreated,Providername,Id,Leveldisplayname,Message
            }
        else
            {
            $output | Sort-Object TimeCreated | Format-Table Timecreated,Providername,Id,Leveldisplayname,Message
            }
    }
 }