More Parsing Event Logs. Another way to do this , referencing part of Brandon Shell and Shay Levi's discussion. This doesn't parse the unformatted message text into object as I did in the post before. In any event, it would be useful to get away from using findstr.exe.
$now = [System.DateTime]::get_now()
$now.ToShortDateString()
$Now_ToString = $now.ToShortDateString()
get-eventlog -logname Security | where-object {($_.timegenerated -match "$Now_ToString") -and ($_.message -match "Windows Firewall")} | fl * | findstr "Port number"
# or
get-eventlog -logname Security | where-object {($_.timegenerated -match "$Now_ToString") -and ($_.message -match "Port number")} | fl * | findstr "Port number"
No comments:
Post a Comment