Showing posts with label Failure Analysis. Show all posts
Showing posts with label Failure Analysis. Show all posts

Sunday, September 14, 2008

More Parsing Event Logs. Another way to do this , referencing part  of Brandon Shell and  Shay Levi's discussion. This doesn't parse the unformatted message text into object as I did in the post before.  In any event, it would be useful to get away from using findstr.exe.

$now = [System.DateTime]::get_now()
$now.ToShortDateString()
$Now_ToString = $now.ToShortDateString()
get-eventlog -logname Security | where-object {($_.timegenerated -match "$Now_ToString") -and ($_.message -match "Windows Firewall")}  | fl * |  findstr "Port number"
# or
get-eventlog -logname Security | where-object {($_.timegenerated -match "$Now_ToString") -and ($_.message -match "Port number")}  | fl * | findstr "Port number"