Tags van Technorati:
Powershell,
eventlog,
reader,
Get-Eventlog,
use
Microsoft form with powershell
So here i am back with another handy script for the IT administrator.
Question: are you, like me, fed up with the tedious way Microsoft event log
are to be retrieved and viewed? then i might have a (PowerShell) solution for
you!
In this script i have taken some AD PowerShell plugin functions and combined
it with a few .Net forms. (thanks to a
post on
Microsoft TechNet_ furthermore i added
Get-Eventlog Cmdlet to
derive any eventlog content from any machine you can access in one script. the
script fetches only the first n (asked in the script “how many lines”) recent
Errors or failures.
# this script reads eventlog from any Computer you can access
# Script
build by Bas Huygen February 2013
# the MS forms procedures are from
Microsoft:
http://technet.microsoft.com/en-us/library/ff730941.aspx
$ErrorActionPreference
= "SilentlyContinue"
Do{
# Procedure 1: Get all AD computers and make a selection by filtering
it
Clear-Host
$compfilter = Read-Host("please make a selection of
computers, this can be one name or a range by the use of *
(wildcards)")
If($compfilter -eq ""){$compfilter = "*"}
$allcomps =
Get-ADComputer -filter * |Select-Object Name |Sort-Object name |where {$_.name
-like "$compfilter"}
# Procedure 2: Select a computer in a form
[void]
[System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
[void]
[System.Reflection.Assembly]::LoadWithPartialName("System.Drawing")
$objForm2 = New-Object System.Windows.Forms.Form
$objForm2.Text = "Select
a Computer"
$objForm2.Size = New-Object System.Drawing.Size(300,200)
$objForm2.StartPosition = "CenterScreen"
$objForm2.KeyPreview = $True
$objForm2.Add_KeyDown({if ($_.KeyCode -eq
"Enter")
{$x=$objListBoxcmp.SelectedItem;$objForm2.Close()}})
$objForm2.Add_KeyDown({if
($_.KeyCode -eq "Escape")
{$objForm2.Close()}})
$OKButton2 = New-Object System.Windows.Forms.Button
$OKButton2.Location =
New-Object System.Drawing.Size(75,120)
$OKButton2.Size = New-Object
System.Drawing.Size(75,23)
$OKButton2.Text =
"OK"
$OKButton2.Add_Click({$x=$objListBoxcmp.SelectedItem;$objForm2.Close()})
$objForm2.Controls.Add($OKButton2)
$CancelButton2 = New-Object
System.Windows.Forms.Button
$CancelButton2.Location = New-Object
System.Drawing.Size(150,120)
$CancelButton2.Size = New-Object
System.Drawing.Size(75,23)
$CancelButton2.Text =
"Cancel"
$CancelButton2.Add_Click({$objForm2.Close()})
$objForm2.Controls.Add($CancelButton2)
$objLabel2 = New-Object System.Windows.Forms.Label
$objLabel2.Location =
New-Object System.Drawing.Size(10,20)
$objLabel2.Size = New-Object
System.Drawing.Size(280,20)
$objLabel2.Text = "Please select a
computer:"
$objForm2.Controls.Add($objLabel2)
$objListBoxcmp = New-Object System.Windows.Forms.ListBox
$objListBoxcmp.Location = New-Object System.Drawing.Size(10,40)
$objListBoxcmp.Size = New-Object System.Drawing.Size(260,20)
$objListBoxcmp.Height = 80
# loop through all compyters filtered out of the AD in procedure 1
ForEach
($c in $allcomps){[void] $objListBoxcmp.Items.Add($c.name)}
$objForm2.Controls.Add($objListBoxcmp)
$objForm2.Topmost = $True
$objForm2.Add_Shown({$objForm2.Activate()})
[void]
$objForm2.ShowDialog()
$trgHost = $objListBoxcmp.Text
# Procedure 3: Select an Eventlog Source in a form
#[void]
[System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
#[void]
[System.Reflection.Assembly]::LoadWithPartialName("System.Drawing")
$objForm = New-Object System.Windows.Forms.Form
$objForm.Text = "Select
an Eventlog Source"
$objForm.Size = New-Object System.Drawing.Size(300,200)
$objForm.StartPosition = "CenterScreen"
$objForm.KeyPreview = $True
$objForm.Add_KeyDown({if ($_.KeyCode -eq
"Enter")
{$x=$objListBox.SelectedItem;$objForm.Close()}})
$objForm.Add_KeyDown({if
($_.KeyCode -eq "Escape")
{$objForm.Close()}})
$OKButton = New-Object System.Windows.Forms.Button
$OKButton.Location =
New-Object System.Drawing.Size(75,120)
$OKButton.Size = New-Object
System.Drawing.Size(75,23)
$OKButton.Text =
"OK"
$OKButton.Add_Click({$x=$objListBox.SelectedItem;$objForm.Close()})
$objForm.Controls.Add($OKButton)
$CancelButton = New-Object
System.Windows.Forms.Button
$CancelButton.Location = New-Object
System.Drawing.Size(150,120)
$CancelButton.Size = New-Object
System.Drawing.Size(75,23)
$CancelButton.Text =
"Cancel"
$CancelButton.Add_Click({$objForm.Close()})
$objForm.Controls.Add($CancelButton)
$objLabel = New-Object System.Windows.Forms.Label
$objLabel.Location =
New-Object System.Drawing.Size(10,20)
$objLabel.Size = New-Object
System.Drawing.Size(280,20)
$objLabel.Text = "Please select an Eventlog
source:"
$objForm.Controls.Add($objLabel)
$objListBox = New-Object System.Windows.Forms.ListBox
$objListBox.Location = New-Object System.Drawing.Size(10,40)
$objListBox.Size = New-Object System.Drawing.Size(260,20)
$objListBox.Height = 80
[void] $objListBox.Items.Add("System")
[void]
$objListBox.Items.Add("Application")
[void]
$objListBox.Items.Add("Security")
$objForm.Controls.Add($objListBox)
$objForm.Topmost = $True
$objForm.Add_Shown({$objForm.Activate()})
[void] $objForm.ShowDialog()
$evtLog = $objListBox.Text
$howmany = Read-host ("How many lines should i
fetch? (blank fetches 25 lines)")
If ($howmany -eq ""){$howmany =
25}
If($evtLog -eq "Security"){$errtype = "failureaudit"} else{ $errtype =
"error"}
# now get the eventlog from the selection
Get-EventLog
-ComputerName $trgHost $evtLog -Newest $howmany -EntryType
$errtype
Get-EventLog -ComputerName $trgHost $evtLog -Newest $howmany
-EntryType $errtype | group-object -property source -noelement |
sort-object
-property count -descending
$erID = Read-Host("Zoom in to a specific event? (give IDnumber)")
If($erID
-eq ""){}else{Get-EventLog -ComputerName $trgHost $evtLog -Newest $howmany
-EntryType $errtype |?{$_.Index -like $erID} |select Message}
$again =
Read-Host("Start again? (y)")
}while($again -eq "y" -or $again -eq "Y")
its output will like something like this:
Have fun, comments are welcome and till next time!
