Sunday, September 14, 2008

More Parsing Event Logs. Another way to do this , referencing part  of Brandon Shell and  Shay Levi's discussion. This doesn't parse the unformatted message text into object as I did in the post before.  In any event, it would be useful to get away from using findstr.exe.

$now = [System.DateTime]::get_now()
$now.ToShortDateString()
$Now_ToString = $now.ToShortDateString()
get-eventlog -logname Security | where-object {($_.timegenerated -match "$Now_ToString") -and ($_.message -match "Windows Firewall")}  | fl * |  findstr "Port number"
# or
get-eventlog -logname Security | where-object {($_.timegenerated -match "$Now_ToString") -and ($_.message -match "Port number")}  | fl * | findstr "Port number"

No comments: