Powershell 查询 Windows 日志的方法
<p>论坛里面有人询问如何使用powershell脚本查询文件修改的审计日志，豆子服务器没开这个功能，不过尝试写了个类似的脚本可以查询日志，并输出对应的xml内容。</p><p>基本方法是get-winevent, 可以指定对应的eventid，获取列表。如果想获取这个事件具体的内容，需要根据不同事件的xml内容进行变化。</p>
<p>比如</p>
<div class="jb51code">
<pre class="brush:ps;">
$Events = Get-WinEvent -ComputerName syddc01 -FilterHashtable @{Logname='Security';Id=4771} -MaxEvents 1
$eventXML = $Event.ToXml()
$eventxml.event.event.data </pre>
</div>
<p><img title="5.PNG" alt="wKioL1X4-cOxNGptAADLqd6u8fc788.jpg" src="https://img.jbzj.com/file_images/article/201510/2015101017023118.jpg" /></p>
<p>根据这个思路，我如果想获取最新的20个4771的事件日志，并输出结果</p>
<div class="jb51code">
<pre class="brush:ps;">
$Events = Get-WinEvent -ComputerName syddc01 -FilterHashtable @{Logname='Security';Id=4771} -MaxEvents 20
# Parse out the event message data
ForEach ($Event in $Events) {
# Convert the event to XML
$eventXML = $Event.ToXml()
# Iterate through each one of the XML message properties
For ($i=0; $i -lt $eventXML.Event.EventData.Data.Count; $i++) {
# Append these as object properties
Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name $eventXML.Event.EventData.Data[$i].name -Value $eventXML.Event.EventData.Data[$i].'#text'
}
}
$events | select Message, TargetUserName, ipaddress,timecreated | Out-GridView
</pre>
</div>
<p><img title="4.PNG" alt="wKioL1X4-iPDwCAuAANhZPcU2WY929.jpg" src="https://img.jbzj.com/file_images/article/201510/2015101017023119.jpg" /></p>
<p>有的时候，事件的数目很多，我希望对这个时间进行一个限制。千万别用 where-object 的方式来过滤，不然等到地老天荒也未必出结果。<br />
我们需要通过哈希表来过滤<br />
</p>
<div class="jb51code">
<pre class="brush:ps;">
$endtime=get-date
$starttime=$endtime.addminutes(-1)
$eventcritea = @{logname='security';id=4740;starttime=$starttime;endtime=$endtime}</pre>
</div>
<p>另外一种常见的方式是通过xmlfilter来过滤日志</p>
<p>首先，我们可以通过event viewer来自定义一个xpath<br />
</p>
<p><img title="0.PNG" alt="wKioL1X4-uqzi5EaAADOjL7kW3U689.jpg" src="https://img.jbzj.com/file_images/article/201510/2015101017023120.jpg" style="float: none" /></p>
<p><img title="1.PNG" alt="wKiom1X4-UWAiui2AAGGHaznvrM148.jpg" src="https://img.jbzj.com/file_images/article/201510/2015101017023121.jpg" style="float: none" /></p>
<p><img title="2.PNG" alt="wKioL1X4-3yxulR8AAEV0mqB1HM575.jpg" src="https://img.jbzj.com/file_images/article/201510/2015101017023122.jpg" style="float: none" /></p>
<p>因为是不同的事件，他的eventdata结果是不一样的，因此我做了些变动。</p>
<div class="jb51code">
<pre class="brush:ps;">
$xmlFilter = @"
<QueryList>
<Query Id="0" Path="Application">
<Select Path="Application">*]]</Select>
</Query>
</QueryList>
“@
#Get-WinEvent -ComputerName $DC.DC -LogName Security -FilterXPath "*]]" #-MaxEvents 50
$Events = Get-WinEvent -ComputerName syddc01 -FilterXML $xmlFilter
ForEach ($Event in $Events) {
# Convert the event to XML
$eventXML = $Event.ToXml()
# Iterate through each one of the XML message properties
For ($i=0; $i -lt $eventXML.Event.EventData.Data.Count; $i++) {
# Append these as object properties
Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name "App" -Value $eventXML.Event.EventData.Data
}
}
$Events | select Message, App, providerName, timecreated | Out-GridView
</pre>
</div>
<p>结果如下</p>
<p><img title="3.PNG" alt="wKiom1X4-LfAh_1ZAAIHTGF2q2I120.jpg" src="https://img.jbzj.com/file_images/article/201510/2015101017023123.jpg" style="float: none" /></p>
<p>最后再给一个例子，我希望获取lockout用户的信息以及他们是在哪里被锁住的，这个日志我们查看4771或者4740。4771的日志过多，查询太慢，所以这里我已4740为例。</p>
<div class="jb51code">
<pre class="brush:ps;">
eventcritea = @{logname='security';id=4740}
$Events =get-winevent -ComputerName (Get-ADDomain).pdcemulator -FilterHashtable $eventcritea
#$Events = Get-WinEvent -ComputerName syddc01 -Filterxml $xmlfilter
# Parse out the event message data
ForEach ($Event in $Events) {
# Convert the event to XML
$eventXML = $Event.ToXml()
# Iterate through each one of the XML message properties
For ($i=0; $i -lt $eventXML.Event.EventData.Data.Count; $i++) {
# Append these as object properties
Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name $eventXML.Event.EventData.Data[$i].name -Value $eventXML.Event.EventData.Data[$i].'#text'
}
}
$events | select TargetUserName,timecreated, targetdomainname | Out-GridView -Title LockOutStatus
break;
Search-ADAccount -LockedOut | ForEach-Object {Unlock-ADAccount -Identity $_.distinguishedname }</pre>
</div>
<p><img title="Capture.PNG" alt="wKioL1YCTLTT2ydOAAKYKU8Qewo401.jpg" src="https://img.jbzj.com/file_images/article/201510/2015101017023124.jpg" /></p>
<p>本文出自 “麻婆豆腐” 博客</p>
頁:
[1]