Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #Require -RunAsAdministrator
- #Require -version 7
- Set-StrictMode -Version 4
- # Made this a bit easier to read by using specific methods (pretty sure your start time is just doing 5 days in past)
- $start = (Get-Date).AddDays(-5)
- $end = (Get-Date).AddSeconds(-1)
- $homedir = "$env:HOMEDRIVE\SCRIPTS\EventLog-Parallel"
- # New-Item -Force doesnt overwrite directory, so you can skip the test-path
- New-Item -ItemType Directory -Path $homedir -Force | Out-Null
- # Instead of a bunch of if statements, and your filenames all follow same pattern, this is just a hashtable
- # The only thing that changes in the if statements is the filename part, so we're mapping the log file name to the filter properties
- $Map = [hashtable]::Synchronized(@{
- 'SystemError' = @{ LogName = 'System'; Level = 2; StartTime = $start; EndTime = $end }
- 'SystemWarning' = @{ LogName = 'System'; Level = 3; StartTime = $start; EndTime = $end }
- 'SystemInformation' = @{ LogName = 'System'; Level = 4; StartTime = $start; EndTime = $end }
- 'ApplicationError' = @{ LogName = 'Application'; Level = 2; StartTime = $start; EndTime = $end }
- 'ApplicationWarning' = @{ LogName = 'Application'; Level = 3; StartTime = $start; EndTime = $end }
- 'ApplicationInformation' = @{ LogName = 'Application'; Level = 4; StartTime = $start; EndTime = $end }
- 'Security' = @{ LogName = 'Security'; Level = 0; StartTime = $start; EndTime = $end }
- })
- $error.Clear()
- $Map.Keys | Foreach-Object {
- $filename = "$homedir\${name}_$($filter.StartTime.ToString("yyyy-MM-dd_HHmmss")).json"
- # Rather than doing Foreach-Parallel, we're just doing start-job for each of them so we can pass parameters to the threads
- Start-Job -Name $_ -ScriptBlock {
- param($filter,$filename)
- # Null coalescer instead of try/catch (idk this might break im just fuckin around)
- $ev = (Get-WinEvent -FilterHashtable $filter -ErrorAction SilentlyContinue |
- Select-Object TimeCreated,LogName,ProviderName,Id,RecordId,Message) ?? $null
- $ev | ConvertTo-Json | Out-File $filename -Force -Confirm:$false
- } -ArgumentList @($Map[$_], $filename) | Out-Null
- }
- # This will spit out empty if there are no errors, so no if statements really needed
- $error | Foreach-Object {$_}
Add Comment
Please, Sign In to add comment