Collecting event logs-CodePudding

I want to collect all the event logs since a defined timestamp. Here there is my chunck code:

$StartTime = (Get-Date).AddMinutes(-5)

$rawdata = Get-WinEvent -ListLog *

$eventlogs = @{}

foreach ($record in $rawdata) {
    if ($record.LastWriteTime -gt $StartTime) {
        $eventlogs[$record.GetHashCode()] = @{
            'LogType' = $record.LogType
            'Name' = $record.LogName
            'Provider' = $record.OwningProviderName
            'Path' = $record.LogFilePath
            'Mode' = $record.LogMode
            'Time' = $record.LastWriteTime
        }
    }
}

In addition to the above info, how can I retrieve a full extended description of each event log? I would like to avoid parsing each single .evtx file

CodePudding user response：

Best way to do that is to use FilterXml parameter of Get-WinEvent. You can actually create your filter by creating a filter using Event Viewer:

After that you copy > paste that in PowerShell. Also you will need to escape single quotation marks that surround time '2021-11-23T10:00:00.000Z' should become ''2021-11-23T10:00:00.000Z'' . NB, those are 2 * ', not double quote ". Of course if you want to pass dates via variable, you can do that by using Get-Date

$filterXml = '
<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[TimeCreated[@SystemTime&gt;=''2021-11-23T10:00:00.000Z'' and @SystemTime&lt;=''2021-11-23T14:03:00.999Z'']]]</Select>
  </Query>
</QueryList>'

Get-WinEvent –FilterXml $filterXml

CodePudding user response：

Not sure about reading extended descriptions, but you can read the event log with the following. Note logname allows wild cards, thus the *.

$time = (get-date).AddMinutes(-5)
Get-WinEvent  –FilterHashtable @{logname='*'; starttime=$time}