Parse Events via PowerShell into table. Ever have need to parse an event, and grab a field from the event description, then perform some action after that?
Here’s some PowerShell that may help you first to create a table, then setup columns, gather data, then parse what you need, and run a command to then output to the table
Use Get-WinEvent to use XML and filters from event viewer, to mine an event, including examples for a specific string, from a specific event, in a specific event log?
Hopefully this post will help with a few tips to simplify monitoring for events, whether in AzMon, SCOM, or via PowerShell.
Let’s start with the Dr Scripto blog post from quite a while ago –
Use Get-WinEvent to use XML and filters from event viewer
The Tip or Trick part of this – leverage your Event Viewer Filter as a query to use with get-WinEvent
Credit for this tip comes from Andrew Blumhardt!
See below for examples to ‘use Get-WinEvent to use XML and filters from event viewer’
Navigating via Event Viewer:
Hop onto your favorite server, or connect to another server via Event Viewer
Go to the Event Log > Click Filter Current Log
Build out your filter (i.e. choose specific Event Sources, exclude events, include severities, timeframe (start/end), etc.)
Switch to the XML tab (and note you can edit your query further!)
You can copy the query from the Event Viewer into your Get-WinEvent syntax
$query = @”
<QueryList> <Query Id=”0″ Path=”Application”> <Select Path=”Application”>*[System[Provider[@Name=’Microsoft.SystemCenter.VirtualMachineManager.2012.Monitor.UserRoleQuotaUsageMonitor’ or @Name=’Microsoft.SystemCenter.VirtualMachineManager.2012.Report.ServiceUsageCollection’ or @Name=’Microsoft.SystemCenter.VirtualMachineManager.2012.Report.VMUsageCollection’ or @Name=’Microsoft.SystemCenter.VirtualMachineManager.2016.EnableCredSSPClient’ or @Name=’Microsoft.SystemCenter.VirtualMachineManager.2016.Monitor.UserRoleQuotaUsageMonitor’ or @Name=’Microsoft.SystemCenter.VirtualMachineManager.2016.Report.ServiceUsageCollection’ or @Name=’Microsoft.SystemCenter.VirtualMachineManager.2016.Report.VMUsageCollection’] and (Level=2 or Level=3) and (EventID=25933)]]</Select> </Query> </QueryList>
“@
Get-WinEvent -FilterXml $query
PowerShell output
Example 3
Grab System Event Log, Event ID 5827 (NetLogon denied events)
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.