PowerShell Windows Event Log Monitoring | Archive

Tom_Lasswell · 2016-02-07T10:13:49Z

Switch from WMI based event log monitoring to PowerShell based. The command Get-WinEvent does not require PS-Remoting to be enabled and can use WMI pass-thru credentials (wmi.user and wmi.pass). This is going to be much more efficient than using WMI to grab event log data. Example to get via JSON (though I was not yet able to get this to work properly with script based eventsource).$events = Get-WinEvent -ComputerName $hostname -Credential $remotecredential -LogName Application$events | Select-Object @{Name = "happenedOn"; Expression = {$_.TimeCreated}}, @{Name = "Severity"; Expression = {$_.LevelDisplayName}}, message, @{Name = "Source"; Expression = {$_.ProviderName}} | ConvertTo-Json$arr=@{}$arr["events"] = @{}$arr.events = $events | Select-Object @{Name = "happenedOn"; Expression = {[string]$_.TimeCreated}}, @{Name = "Severity"; Expression = {$_.LevelDisplayName}}, message, @{Name = "Source"; Expression = {$_.ProviderName}}$arr | ConvertTo-Json

MoreDiscussions

PowerShell Windows Event Log Monitoring | Archive | LogicMonitor Community