Powershell 查詢 Windows 日志的方法

2020-03-26 19:07:29

字體：大中小

供稿：網(wǎng)友

論壇里面有人詢問如何使用powershell腳本查詢文件修改的審計(jì)日志，豆子服務(wù)器沒開這個(gè)功能，不過嘗試寫了個(gè)類似的腳本可以查詢?nèi)罩?，并輸出?duì)應(yīng)的xml內(nèi)容。

基本方法是get-winevent, 可以指定對(duì)應(yīng)的eventid，獲取列表。如果想獲取這個(gè)事件具體的內(nèi)容，需要根據(jù)不同事件的xml內(nèi)容進(jìn)行變化。

比如

$Events = Get-WinEvent -ComputerName syddc01 -FilterHashtable @{Logname='Security';Id=4771} -MaxEvents 1 $eventXML = [xml]$Event.ToXml() $eventxml.event.event.data

Windows,日志,Powershell

根據(jù)這個(gè)思路，我如果想獲取最新的20個(gè)4771的事件日志，并輸出結(jié)果

$Events = Get-WinEvent -ComputerName syddc01 -FilterHashtable @{Logname='Security';Id=4771} -MaxEvents 20            # Parse out the event message data       ForEach ($Event in $Events) {         # Convert the event to XML         $eventXML = [xml]$Event.ToXml()         # Iterate through each one of the XML message properties         For ($i=0; $i -lt $eventXML.Event.EventData.Data.Count; $i++) {                # Append these as object properties           Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name $eventXML.Event.EventData.Data[$i].name -Value $eventXML.Event.EventData.Data[$i].'#text'        }       }            $events | select Message, TargetUserName, ipaddress,timecreated | Out-GridView

Windows,日志,Powershell

有的時(shí)候，事件的數(shù)目很多，我希望對(duì)這個(gè)時(shí)間進(jìn)行一個(gè)限制。千萬(wàn)別用 where-object 的方式來過濾，不然等到地老天荒也未必出結(jié)果。
我們需要通過哈希表來過濾

$endtime=get-date$starttime=$endtime.addminutes(-1) $eventcritea = @{logname='security';id=4740;starttime=$starttime;endtime=$endtime}

另外一種常見的方式是通過xmlfilter來過濾日志

首先，我們可以通過event viewer來自定義一個(gè)xpath

Windows,日志,Powershell

因?yàn)槭遣煌氖录膃ventdata結(jié)果是不一樣的，因此我做了些變動(dòng)。

[xml]$xmlFilter = @" <QueryList>  <Query Id="0" Path="Application">   <Select Path="Application">*[System[(EventID=1002) and TimeCreated[timediff(@SystemTime) <= 604800000]]]</Select>  </Query> </QueryList> “@ #Get-WinEvent -ComputerName $DC.DC -LogName Security -FilterXPath "*[System[(EventID=529 or EventID=644 or EventID=675 or EventID=676 or EventID=681 or EventID=4625) and TimeCreated[timediff(@SystemTime) <= 86400000]]]" #-MaxEvents 50 $Events = Get-WinEvent -ComputerName syddc01 -FilterXML $xmlFilter ForEach ($Event in $Events) {         # Convert the event to XML         $eventXML = [xml]$Event.ToXml()         # Iterate through each one of the XML message properties         For ($i=0; $i -lt $eventXML.Event.EventData.Data.Count; $i++) {                # Append these as object properties           Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name "App" -Value $eventXML.Event.EventData.Data[5]        }       }   $Events | select Message, App, providerName, timecreated | Out-GridView

結(jié)果如下

Windows,日志,Powershell

最后再給一個(gè)例子，我希望獲取lockout用戶的信息以及他們是在哪里被鎖住的，這個(gè)日志我們查看4771或者4740。4771的日志過多，查詢太慢，所以這里我已4740為例。

eventcritea = @{logname='security';id=4740} $Events =get-winevent -ComputerName (Get-ADDomain).pdcemulator -FilterHashtable $eventcritea #$Events = Get-WinEvent -ComputerName syddc01 -Filterxml $xmlfilter            # Parse out the event message data       ForEach ($Event in $Events) {         # Convert the event to XML         $eventXML = [xml]$Event.ToXml()           # Iterate through each one of the XML message properties         For ($i=0; $i -lt $eventXML.Event.EventData.Data.Count; $i++) {                # Append these as object properties           Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name $eventXML.Event.EventData.Data[$i].name -Value $eventXML.Event.EventData.Data[$i].'#text'        }       }            $events | select TargetUserName,timecreated, targetdomainname | Out-GridView -Title LockOutStatus break; Search-ADAccount -LockedOut | ForEach-Object {Unlock-ADAccount -Identity $_.distinguishedname }

Windows,日志,Powershell