PSEventViewer.psm1
|
<#
.SYNOPSIS This PowerShell module simplifies parsing Windows Event Log, has some problems thou... that will be addressed later .DESCRIPTION This PowerShell module simplifies parsing Windows Event Log, has some problems thou... that will be addressed later .NOTES Version: 0.30 Author: Przemyslaw Klys <przemyslaw.klys at evotec.pl> Get-WinEvent Help: - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-6 .EXAMPLE $DateFrom = (get-date).AddHours(-5) $DateTo = (get-date).AddHours(1) get-events -Computer "Evo1" -DateFrom $DateFrom -DateTo $DateTo -EventId 916 -LogType "Application" #> function Add-ToHashTable($Hashtable, $Key, $Value) { if ($Value -ne $null -and $Value -ne '') { $Hashtable.Add($Key, $Value) } } Function Split-Every($list, $count = 4) { $aggregateList = @() $blocks = [Math]::Floor($list.Count / $count) $leftOver = $list.Count % $count $start = $end = 0 for ($i = 0; $i -lt $blocks; $i++) { $end = $count * ($i + 1) - 1 $aggregateList += @(, $list[$start..$end]) $start = $end + 1 } if ($leftOver -gt 0) { $aggregateList += @(, $list[$start..($end + $leftOver)]) } $aggregateList } function Split-Array { <# .SYNOPSIS Split an array .NOTES Version : July 2, 2017 - implemented suggestions from ShadowSHarmon for performance .PARAMETER inArray A one dimensional array you want to split .EXAMPLE Split-array -inArray @(1,2,3,4,5,6,7,8,9,10) -parts 3 .EXAMPLE Split-array -inArray @(1,2,3,4,5,6,7,8,9,10) -size 3 #> param($inArray, [int]$parts, [int]$size) if ($parts) { $PartSize = [Math]::Ceiling($inArray.count / $parts) } if ($size) { $PartSize = $size $parts = [Math]::Ceiling($inArray.count / $size) } $outArray = New-Object 'System.Collections.Generic.List[psobject]' for ($i = 1; $i -le $parts; $i++) { $start = (($i - 1) * $PartSize) $end = (($i) * $PartSize) - 1 if ($end -ge $inArray.count) {$end = $inArray.count - 1} $outArray.Add(@($inArray[$start..$end])) } return , $outArray } function Get-Events { [cmdletbinding()] param ( [alias ("ADDomainControllers", "DomainController", "Server", "Servers", "Computer", "Computers")] [string[]] $Machine = $Env:COMPUTERNAME, [alias ("From")][nullable[DateTime]] $DateFrom = $null, [alias ("To")][nullable[DateTime]] $DateTo = $null, [alias ("Ids", "EventID", "EventIds")] [int[]] $ID = $null, [alias ("LogType", "Log")][string] $LogName = $null, [alias ("Provider")] [string] $ProviderName = '', [int] $Level = $null, [string] $UserSID = $null, [string[]]$Data = $null, [int] $MaxEvents = $null, $Credentials = $null, $Path = $null, [long[]] $Keywords = $null, [switch] $Oldest, [switch] $DisableParallel ) Write-Verbose "Get-Events - Overall events processing start" $MeasureTotal = [System.Diagnostics.Stopwatch]::StartNew() # Timer Start if ($PSCmdlet.MyInvocation.BoundParameters["Verbose"].IsPresent) { $Verbose = $true } else { $Verbose = $false } ### Define Runspace $pool = [RunspaceFactory]::CreateRunspacePool(1, [int]$env:NUMBER_OF_PROCESSORS + 1) $pool.ApartmentState = "MTA" $pool.Open() $runspaces = @() ### Define Runspace $AllEvents = @() if ($ID -ne $null) { $ID = $ID | Sort-Object -Unique Write-Verbose "Get-Events - Events to process in Total: $($Id.Count)" Write-Verbose "Get-Events - Events to process in Total ID: $ID" if ($Id.Count -gt 22) { Write-Verbose "Get-Events - There are more events to process then 22, split will be required." Write-Verbose "Get-Events - This means it will take twice the time to make a scan." } } $SplitArrayID = Split-Array -inArray $ID -size 22 # Support for more ID's then 22 (limitation of Get-WinEvent) foreach ($ID in $SplitArrayID) { $EventFilter = @{} Add-ToHashTable -Hashtable $EventFilter -Key "LogName" -Value $LogName # Accepts Wildcard Add-ToHashTable -Hashtable $EventFilter -Key "ProviderName" -Value $ProviderName # Accepts Wildcard Add-ToHashTable -Hashtable $EventFilter -Key "Path" -Value $Path # https://blogs.technet.microsoft.com/heyscriptingguy/2011/01/25/use-powershell-to-parse-saved-event-logs-for-errors/ Add-ToHashTable -Hashtable $EventFilter -Key "Keywords" -Value $Keywords Add-ToHashTable -Hashtable $EventFilter -Key "Id" -Value $ID Add-ToHashTable -Hashtable $EventFilter -Key "Level" -Value $Level Add-ToHashTable -Hashtable $EventFilter -Key "StartTime" -Value $DateFrom Add-ToHashTable -Hashtable $EventFilter -Key "EndTime" -Value $DateTo Add-ToHashTable -Hashtable $EventFilter -Key "UserID" -Value $UserSID Add-ToHashTable -Hashtable $EventFilter -Key "Data" -Value $Data foreach ($Comp in $Machine) { Write-Verbose "Get-Events - Processing computer $Comp for Events ID: $ID" Write-Verbose "Get-Events - Processing computer $Comp for Events ID Count: $($ID.Count)" Write-Verbose "Get-Events - Processing computer $Comp for Events LogName: $LogName" Write-Verbose "Get-Events - Processing computer $Comp for Events ProviderName: $ProviderName" Write-Verbose "Get-Events - Processing computer $Comp for Events Keywords: $Keywords" Write-Verbose "Get-Events - Processing computer $Comp for Events StartTime: $DateFrom" Write-Verbose "Get-Events - Processing computer $Comp for Events EndTime: $DateTo" Write-Verbose "Get-Events - Processing computer $Comp for Events Path: $Path" Write-Verbose "Get-Events - Processing computer $Comp for Events Level: $Level" Write-Verbose "Get-Events - Processing computer $Comp for Events UserID: $UserID" Write-Verbose "Get-Events - Processing computer $Comp for Events Data: $Data" Write-Verbose "Get-Events - Processing computer $Comp for Events MaxEvents: $MaxEvents" Write-Verbose "Get-Events - Processing computer $Comp for Events Path: $Path" Write-Verbose "Get-Events - Processing computer $Comp for Events UserSID: $UserSID" Write-Verbose "Get-Events - Processing computer $Comp for Events Oldest: $Oldest" $ScriptBlock = { #[cmdletbinding()] Param ( [string]$Comp, [hashtable]$EventFilter, [int]$MaxEvents, [bool] $Oldest, [bool] $Verbose ) if ($Verbose) { $verbosepreference = 'continue' } function Get-EventsInternal () { #[cmdletbinding()] param ( [string]$Comp, [hashtable]$EventFilter, [int]$MaxEvents, [bool] $Oldest, [bool] $Verbose ) if ($Verbose) { $verbosepreference = 'continue' } Write-Verbose "Get-Events - Inside $Comp executing on: $($Env:COMPUTERNAME)" Write-Verbose "Get-Events - Inside $Comp for Events ID: $($EventFilter.ID)" Write-Verbose "Get-Events - Inside $Comp for Events ID: $($EventFilter.LogName)" Write-Verbose "Get-Events - Inside $Comp for Events Oldest: $Oldest" Write-Verbose "Get-Events - Inside $Comp for Events Max Events: $MaxEvents" Write-Verbose "Get-Events - Inside $Comp for Events Verbose: $Verbose" $Measure = [System.Diagnostics.Stopwatch]::StartNew() # Timer Start $Events = @() try { if ($MaxEvents -ne $null -and $MaxEvents -ne 0) { $Events = Get-WinEvent -FilterHashtable $EventFilter -ComputerName $Comp -MaxEvents $MaxEvents -Oldest:$Oldest -ErrorAction Stop } else { $Events = Get-WinEvent -FilterHashtable $EventFilter -ComputerName $Comp -Oldest:$Oldest -ErrorAction Stop } $EventsCount = ($Events | Measure-Object).Count Write-Verbose -Message "Get-Events - Inside $Comp Events founds $EventsCount" } catch { if ($_.Exception -match "No events were found that match the specified selection criteria") { Write-Verbose -Message "Get-Events - Inside $Comp - No events found." } elseif ($_.Exception -match "There are no more endpoints available from the endpoint") { Write-Verbose -Message "Get-Events - Inside $Comp - Error connecting." Write-Verbose -Message "Get-Events - Inside $Comp - Error $($_.Exception.Message)" } else { Write-Verbose -Message "Get-Events - Inside $Comp - Error connecting." Write-Verbose -Message "Get-Events - Inside $Comp - Error $($_.Exception.Message)" } Write-Verbose "Get-Events - Inside $Comp - Time to generate $($Measure.Elapsed.Hours) hours, $($Measure.Elapsed.Minutes) minutes, $($Measure.Elapsed.Seconds) seconds, $($Measure.Elapsed.Milliseconds) milliseconds" $Measure.Stop() continue } # Parse out the event message data ForEach ($Event in $Events) { # Convert the event to XML $eventXML = [xml]$Event.ToXml() # Iterate through each one of the XML message properties Add-Member -InputObject $Event -MemberType NoteProperty -Name "Computer" -Value $event.MachineName.ToString() -Force Add-Member -InputObject $Event -MemberType NoteProperty -Name "Date" -Value $Event.TimeCreated -Force # Get-Member -inputobject $eventXML.Event if (Get-Member -inputobject $eventXML.Event.EventData -name "Data" -Membertype Properties) { if (Get-Member -inputobject $eventXML.Event.EventData.Data -name "Count" -Membertype Properties) { For ($i = 0; $i -lt $eventXML.Event.EventData.Data.Count; $i++) { if (Get-Member -inputobject $eventXML.Event.EventData.Data[$i] -name "Name" -Membertype Properties) { $fieldName = $eventXML.Event.EventData.Data[$i].Name } else { $fieldName = "" } if (Get-Member -inputobject $eventXML.Event.EventData.Data[$i] -name "#text" -Membertype Properties) { $fieldValue = $eventXML.Event.EventData.Data[$i]."#text" if ($fieldValue -eq "-".Trim()) { $fieldValue = $fieldValue -replace "-" } } else { $fieldValue = "" } # Append these as object properties if ($fieldName -ne "") { Add-Member -InputObject $Event -MemberType NoteProperty -Name $fieldName -Value $fieldValue -Force } } } } } Write-Verbose "Get-Events - Inside $Comp - Time to generate $($Measure.Elapsed.Hours) hours, $($Measure.Elapsed.Minutes) minutes, $($Measure.Elapsed.Seconds) seconds, $($Measure.Elapsed.Milliseconds) milliseconds" $Measure.Stop() return $Events } return Get-EventsInternal -Comp $Comp -EventFilter $EventFilter -MaxEvents $MaxEvents -Oldest:$Oldest -Verbose $Verbose } if ($DisableParallel) { Write-Verbose 'Get-Events - Running query with parallel disabled...' Invoke-Command -ScriptBlock $ScriptBlock -ArgumentList $Comp, $EventFilter, $MaxEvents, $Oldest, $Verbose } else { Write-Verbose 'Get-Events - Running query with parallel enabled...' $runspace = [PowerShell]::Create() $null = $runspace.AddScript($ScriptBlock) $null = $runspace.AddParameter('Comp', $Comp) $null = $runspace.AddParameter('EventFilter', $EventFilter) $null = $runspace.AddParameter('MaxEvents', $MaxEvents) $null = $runspace.AddParameter('Oldest', $Oldest) $null = $runspace.AddParameter('Verbose', $Verbose) $runspace.RunspacePool = $pool $runspaces += [PSCustomObject]@{ Pipe = $runspace; Status = $runspace.BeginInvoke() } } } } ### End Runspaces while ($runspaces.Status -ne $null) { $completed = $runspaces | Where-Object { $_.Status.IsCompleted -eq $true } foreach ($runspace in $completed) { foreach ($e in $($runspace.Pipe.Streams.Error)) { Write-Verbose "Get-Events - Error from runspace: $e" } foreach ($v in $($runspace.Pipe.Streams.Verbose)) { Write-Verbose "Get-Events - Verbose from runspace: $v" } $AllEvents += $runspace.Pipe.EndInvoke($runspace.Status) $runspace.Status = $null } } $pool.Close() $pool.Dispose() ### End Runspaces $EventsProcessed = ($AllEvents | Measure-Object).Count Write-Verbose "Get-Events - Overall events processed in total for the report: $EventsProcessed" Write-Verbose "Get-Events - Overall time to generate $($MeasureTotal.Elapsed.Hours) hours, $($MeasureTotal.Elapsed.Minutes) minutes, $($MeasureTotal.Elapsed.Seconds) seconds, $($MeasureTotal.Elapsed.Milliseconds) milliseconds" $MeasureTotal.Stop() Write-Verbose "Get-Events - Overall events processing end" return $AllEvents } Function ConvertTo-FlatObject { <# .SYNOPSIS Flatten an object to simplify discovery of data .DESCRIPTION Flatten an object. This function will take an object, and flatten the properties using their full path into a single object with one layer of properties. You can use this to flatten XML, JSON, and other arbitrary objects. This can simplify initial exploration and discovery of data returned by APIs, interfaces, and other technologies. NOTE: Use tools like Get-Member, Select-Object, and Show-Object to further explore objects. This function does not handle certain data types well. It was original designed to expand XML and JSON. .PARAMETER InputObject Object to flatten .PARAMETER Exclude Exclude any nodes in this list. Accepts wildcards. Example: -Exclude price, title .PARAMETER ExcludeDefault Exclude default properties for sub objects. True by default. This simplifies views of many objects (e.g. XML) but may exclude data for others (e.g. if flattening a process, ProcessThread properties will be excluded) .PARAMETER Include Include only leaves in this list. Accepts wildcards. Example: -Include Author, Title .PARAMETER Value Include only leaves with values like these arguments. Accepts wildcards. .PARAMETER MaxDepth Stop recursion at this depth. .INPUTS Any object .OUTPUTS System.Management.Automation.PSCustomObject .EXAMPLE #Pull unanswered PowerShell questions from StackExchange, Flatten the data to date a feel for the schema Invoke-RestMethod "https://api.stackexchange.com/2.0/questions/unanswered?order=desc&sort=activity&tagged=powershell&pagesize=10&site=stackoverflow" | ConvertTo-FlatObject -Include Title, Link, View_Count $object.items[0].owner.link : http://stackoverflow.com/users/1946412/julealgon $object.items[0].view_count : 7 $object.items[0].link : http://stackoverflow.com/questions/26910789/is-it-possible-to-reuse-a-param-block-across-multiple-functions $object.items[0].title : Is it possible to reuse a 'param' block across multiple functions? $object.items[1].owner.link : http://stackoverflow.com/users/4248278/nitin-tyagi $object.items[1].view_count : 8 $object.items[1].link : http://stackoverflow.com/questions/26909879/use-powershell-to-retreive-activated-features-for-sharepoint-2010 $object.items[1].title : Use powershell to retreive Activated features for sharepoint 2010 ... .EXAMPLE #Set up some XML to work with $object = [xml]' <catalog> <book id="bk101"> <author>Gambardella, Matthew</author> <title>XML Developers Guide</title> <genre>Computer</genre> <price>44.95</price> </book> <book id="bk102"> <author>Ralls, Kim</author> <title>Midnight Rain</title> <genre>Fantasy</genre> <price>5.95</price> </book> </catalog>' #Call the flatten command against this XML ConvertTo-FlatObject $object -Include Author, Title, Price #Result is a flattened object with the full path to the node, using $object as the root. #Only leaf properties we specified are included (author,title,price) $object.catalog.book[0].author : Gambardella, Matthew $object.catalog.book[0].title : XML Developers Guide $object.catalog.book[0].price : 44.95 $object.catalog.book[1].author : Ralls, Kim $object.catalog.book[1].title : Midnight Rain $object.catalog.book[1].price : 5.95 #Invoking the property names should return their data if the orginal object is in $object: $object.catalog.book[1].price 5.95 $object.catalog.book[0].title XML Developers Guide .EXAMPLE #Set up some XML to work with [xml]'<catalog> <book id="bk101"> <author>Gambardella, Matthew</author> <title>XML Developers Guide</title> <genre>Computer</genre> <price>44.95</price> </book> <book id="bk102"> <author>Ralls, Kim</author> <title>Midnight Rain</title> <genre>Fantasy</genre> <price>5.95</price> </book> </catalog>' | ConvertTo-FlatObject -exclude price, title, id Result is a flattened object with the full path to the node, using XML as the root. Price and title are excluded. $Object.catalog : catalog $Object.catalog.book : {book, book} $object.catalog.book[0].author : Gambardella, Matthew $object.catalog.book[0].genre : Computer $object.catalog.book[1].author : Ralls, Kim $object.catalog.book[1].genre : Fantasy .EXAMPLE #Set up some XML to work with [xml]'<catalog> <book id="bk101"> <author>Gambardella, Matthew</author> <title>XML Developers Guide</title> <genre>Computer</genre> <price>44.95</price> </book> <book id="bk102"> <author>Ralls, Kim</author> <title>Midnight Rain</title> <genre>Fantasy</genre> <price>5.95</price> </book> </catalog>' | ConvertTo-FlatObject -Value XML*, Fantasy Result is a flattened object filtered by leaves that matched XML* or Fantasy $Object.catalog.book[0].title : XML Developers Guide $Object.catalog.book[1].genre : Fantasy .EXAMPLE #Get a single process with all props, flatten this object. Don't exclude default properties Get-Process | select -first 1 -skip 10 -Property * | ConvertTo-FlatObject -ExcludeDefault $false #NOTE - There will likely be bugs for certain complex objects like this. For example, $Object.StartInfo.Verbs.SyncRoot.SyncRoot... will loop until we hit MaxDepth. (Note: SyncRoot is now addressed individually) .NOTES I have trouble with algorithms. If you have a better way to handle this, please let me know! .FUNCTIONALITY General Command #> [cmdletbinding()] param( [parameter( Mandatory = $True, ValueFromPipeline = $True)] [PSObject[]]$InputObject, [string[]]$Exclude = "", [bool]$ExcludeDefault = $True, [string[]]$Include = $null, [string[]]$Value = $null, [int]$MaxDepth = 10 ) Begin { #region FUNCTIONS #Before adding a property, verify that it matches a Like comparison to strings in $Include... Function IsIn-Include { param($prop) if (-not $Include) {$True} else { foreach ($Inc in $Include) { if ($Prop -like $Inc) { $True } } } } #Before adding a value, verify that it matches a Like comparison to strings in $Value... Function IsIn-Value { param($val) if (-not $Value) {$True} else { foreach ($string in $Value) { if ($val -like $string) { $True } } } } Function Get-Exclude { [cmdletbinding()] param($obj) #Exclude default props if specified, and anything the user specified. Thanks to Jaykul for the hint on [type]! if ($ExcludeDefault) { Try { $DefaultTypeProps = @( $obj.gettype().GetProperties() | Select-Object -ExpandProperty Name -ErrorAction Stop ) if ($DefaultTypeProps.count -gt 0) { Write-Verbose "Excluding default properties for $($obj.gettype().Fullname):`n$($DefaultTypeProps | Out-String)" } } Catch { Write-Verbose "Failed to extract properties from $($obj.gettype().Fullname): $_" $DefaultTypeProps = @() } } @( $Exclude + $DefaultTypeProps ) | Select-Object -Unique } #Function to recurse the Object, add properties to object Function Recurse-Object { [cmdletbinding()] param( $Object, [string[]]$path = '$Object', [psobject]$Output, $depth = 0 ) # Handle initial call Write-Verbose "Working in path $Path at depth $depth" Write-Debug "Recurse Object called with PSBoundParameters:`n$($PSBoundParameters | Out-String)" $Depth++ #Exclude default props if specified, and anything the user specified. $ExcludeProps = @( Get-Exclude $object ) #Get the children we care about, and their names $Children = $object.psobject.properties | Where-Object {$ExcludeProps -notcontains $_.Name } Write-Debug "Working on properties:`n$($Children | Select-Object -ExpandProperty Name | Out-String)" #Loop through the children properties. foreach ($Child in @($Children)) { $ChildName = $Child.Name $ChildValue = $Child.Value Write-Debug "Working on property $ChildName with value $($ChildValue | Out-String)" # Handle special characters... if ($ChildName -match '[^a-zA-Z0-9_]') { $FriendlyChildName = "{$ChildName}" } else { $FriendlyChildName = $ChildName } #Add the property. if ((IsIn-Include $ChildName) -and (IsIn-Value $ChildValue) -and $Depth -le $MaxDepth) { $ThisPath = @( $Path + $FriendlyChildName ) -join "." $Output | Add-Member -MemberType NoteProperty -Name $ThisPath -Value $ChildValue Write-Verbose "Adding member '$ThisPath'" } #Handle null... if ($ChildValue -eq $null) { Write-Verbose "Skipping NULL $ChildName" continue } #Handle evil looping. Will likely need to expand this. Any thoughts on a better approach? if ( ( $ChildValue.GetType() -eq $Object.GetType() -and $ChildValue -is [datetime] ) -or ( $ChildName -eq "SyncRoot" -and -not $ChildValue ) ) { Write-Verbose "Skipping $ChildName with type $($ChildValue.GetType().fullname)" continue } #Check for arrays $IsArray = @($ChildValue).count -gt 1 $count = 0 #Set up the path to this node and the data... $CurrentPath = @( $Path + $FriendlyChildName ) -join "." #Exclude default props if specified, and anything the user specified. $ExcludeProps = @( Get-Exclude $ChildValue ) #Get the children's children we care about, and their names. Also look for signs of a hashtable like type $ChildrensChildren = $ChildValue.psobject.properties | Where-Object {$ExcludeProps -notcontains $_.Name } $HashKeys = if ($ChildValue.Keys -notlike $null -and $ChildValue.Values) { $ChildValue.Keys } else { $null } Write-Debug "Found children's children $($ChildrensChildren | Select-Object -ExpandProperty Name | Out-String)" #> #If we aren't at max depth or a leaf... if ( (@($ChildrensChildren).count -ne 0 -or $HashKeys) -and $Depth -lt $MaxDepth ) { #This handles hashtables. But it won't recurse... if ($HashKeys) { Write-Verbose "Working on hashtable $CurrentPath" foreach ($key in $HashKeys) { Write-Verbose "Adding value from hashtable $CurrentPath['$key']" $Output | Add-Member -MemberType NoteProperty -name "$CurrentPath['$key']" -value $ChildValue["$key"] $Output = Recurse-Object -Object $ChildValue["$key"] -Path "$CurrentPath['$key']" -Output $Output -depth $depth } } #Sub children? Recurse! else { if ($IsArray) { foreach ($item in @($ChildValue)) { Write-Verbose "Recursing through array node '$CurrentPath'" $Output = Recurse-Object -Object $item -Path "$CurrentPath[$count]" -Output $Output -depth $depth $Count++ } } else { Write-Verbose "Recursing through node '$CurrentPath'" $Output = Recurse-Object -Object $ChildValue -Path $CurrentPath -Output $Output -depth $depth } } } } $Output } #endregion FUNCTIONS } Process { Foreach ($Object in $InputObject) { #Flatten the XML and write it to the pipeline Recurse-Object -Object $Object -Output $( New-Object -TypeName PSObject ) } } } Export-ModuleMember -function "Get-Events" |