PSEventViewer.psm1
|
function Get-Events { <# .SYNOPSIS Get-Events is a wrapper function around Get-WinEvent providing additional features and options. .DESCRIPTION Long description .PARAMETER Machine ComputerName or Server you want to query. Takes an array of servers as well. .PARAMETER DateFrom Parameter description .PARAMETER DateTo Parameter description .PARAMETER ID Parameter description .PARAMETER ExcludeID Parameter description .PARAMETER LogName Parameter description .PARAMETER ProviderName Parameter description .PARAMETER NamedDataFilter Parameter description .PARAMETER NamedDataExcludeFilter Parameter description .PARAMETER UserID Parameter description .PARAMETER Level Parameter description .PARAMETER UserSID Parameter description .PARAMETER Data Parameter description .PARAMETER MaxEvents Parameter description .PARAMETER Credentials Parameter description .PARAMETER Path Parameter description .PARAMETER Keywords Parameter description .PARAMETER RecordID Parameter description .PARAMETER MaxRunspaces Parameter description .PARAMETER Oldest Parameter description .PARAMETER DisableParallel Parameter description .PARAMETER ExtendedOutput Parameter description .PARAMETER ExtendedInput Parameter description .EXAMPLE An example .NOTES General notes #> [CmdLetBinding()] param ( [alias ("ADDomainControllers", "DomainController", "Server", "Servers", "Computer", "Computers", "ComputerName")] [string[]] $Machine = $Env:COMPUTERNAME, [alias ("StartTime", "From")][nullable[DateTime]] $DateFrom = $null, [alias ("EndTime", "To")][nullable[DateTime]] $DateTo = $null, [alias ("Ids", "EventID", "EventIds")] [int[]] $ID = $null, [alias ("ExludeEventID")][int[]] $ExcludeID = $null, [alias ("LogType", "Log")][string] $LogName = $null, [alias ("Provider")] [string] $ProviderName = '', [hashtable] $NamedDataFilter, [hashtable] $NamedDataExcludeFilter, [string[]] $UserID, [PSEventViewer.Level[]] $Level = $null, [string] $UserSID = $null, [string[]]$Data = $null, [int] $MaxEvents = $null, [PSCredential] $Credentials = $null, [string] $Path = $null, [PSEventViewer.Keywords[]] $Keywords = $null, [alias("EventRecordID")][int64] $RecordID, [int] $MaxRunspaces = [int]$env:NUMBER_OF_PROCESSORS + 1, [switch] $Oldest, [switch] $DisableParallel, [switch] $ExtendedOutput, [Array] $ExtendedInput ) if ($PSCmdlet.MyInvocation.BoundParameters["Verbose"].IsPresent) { $Verbose = $true } else { $Verbose = $false } $MeasureTotal = [System.Diagnostics.Stopwatch]::StartNew() # Timer Start $ParametersList = [System.Collections.Generic.List[Object]]::new() if ($ExtendedInput.Count -gt 0) { # Special input - PSWinReporting requires it [Array] $Param = foreach ($EventEntry in $ExtendedInput) { $EventFilter = @{} if ($EventEntry.Type -eq 'File') { Write-Verbose "Get-Events - Preparing data to scan file $($EventEntry.Server)" Add-ToHashTable -Hashtable $EventFilter -Key "Path" -Value $EventEntry.Server $Comp = $Env:COMPUTERNAME } else { Write-Verbose "Get-Events - Preparing data to scan computer $($EventEntry.Server)" $Comp = $EventEntry.Server } $ConvertedLevels = foreach ($Data in $EventEntry.Level) { ([PSEventViewer.Level]::$Data).value__ } $ConvertedKeywords = foreach ($Data in $EventEntry.Keywords) { ([PSEventViewer.Keywords]::$Data).value__ } Add-ToHashTable -Hashtable $EventFilter -Key "LogName" -Value $EventEntry.LogName Add-ToHashTable -Hashtable $EventFilter -Key "StartTime" -Value $EventEntry.DateFrom Add-ToHashTable -Hashtable $EventFilter -Key "EndTime" -Value $EventEntry.DateTo Add-ToHashTable -Hashtable $EventFilter -Key "Keywords" -Value $ConvertedKeywords Add-ToHashTable -Hashtable $EventFilter -Key "Level" -Value $ConvertedLevels Add-ToHashTable -Hashtable $EventFilter -Key "UserID" -Value $EventEntry.UserSID Add-ToHashTable -Hashtable $EventFilter -Key "Data" -Value $EventEntry.Data Add-ToHashTable -Hashtable $EventFilter -Key "RecordID" -Value $EventEntry.RecordID Add-ToHashTable -Hashtable $EventFilter -Key "NamedDataFilter" -Value $EventEntry.NamedDataFilter Add-ToHashTable -Hashtable $EventFilter -Key "NamedDataExcludeFilter" -Value $EventEntry.NamedDataExcludeFilter Add-ToHashTable -Hashtable $EventFilter -Key "UserID" -Value $EventEntry.UserID Add-ToHashTable -Hashtable $EventFilter -Key "ExcludeID" -Value $EventEntry.ExcludeID if ($Verbose) { foreach ($Key in $EventFilter.Keys) { if ($Key -eq 'NamedDataFilter' -or $Key -eq 'NamedDataExcludeFilter') { foreach ($SubKey in $($EventFilter.$Key).Keys) { Write-Verbose "Get-Events - Filter parameters provided $Key with SubKey $SubKey = $(($EventFilter.$Key.$SubKey) -join ', ')" } } else { Write-Verbose "Get-Events - Filter parameters provided $Key = $(($EventFilter.$Key) -join ', ')" } } } if ($null -ne $EventEntry.EventID) { $ID = $EventEntry.EventID | Sort-Object -Unique Write-Verbose "Get-Events - Events to process in Total (unique): $($Id.Count)" Write-Verbose "Get-Events - Events to process in Total ID: $($ID -join ', ')" if ($Id.Count -gt 22) { Write-Verbose "Get-Events - There are more events to process then 22, split will be required." } $SplitArrayID = Split-Array -inArray $ID -size 22 # Support for more ID's then 22 (limitation of Get-WinEvent) foreach ($EventIdGroup in $SplitArrayID) { $EventFilter.Id = @($EventIdGroup) @{ Comp = $Comp EventFilter = $EventFilter.Clone() MaxEvents = $EventEntry.MaxEvents Oldest = $Oldest Verbose = $Verbose } } } else { @{ Comp = $Comp EventFilter = $EventFilter MaxEvents = $EventEntry.MaxEvents Oldest = $Oldest Verbose = $Verbose } } } if ($null -ne $Param) { $null = $ParametersList.AddRange($Param) } } else { # Standard input $EventFilter = @{} Add-ToHashTable -Hashtable $EventFilter -Key "LogName" -Value $LogName # Accepts Wildcard Add-ToHashTable -Hashtable $EventFilter -Key "ProviderName" -Value $ProviderName # Accepts Wildcard Add-ToHashTable -Hashtable $EventFilter -Key "Path" -Value $Path # https://blogs.technet.microsoft.com/heyscriptingguy/2011/01/25/use-powershell-to-parse-saved-event-logs-for-errors/ Add-ToHashTable -Hashtable $EventFilter -Key "Keywords" -Value $Keywords.value__ Add-ToHashTable -Hashtable $EventFilter -Key "Level" -Value $Level.value__ Add-ToHashTable -Hashtable $EventFilter -Key "StartTime" -Value $DateFrom Add-ToHashTable -Hashtable $EventFilter -Key "EndTime" -Value $DateTo Add-ToHashTable -Hashtable $EventFilter -Key "UserID" -Value $UserSID Add-ToHashTable -Hashtable $EventFilter -Key "Data" -Value $Data Add-ToHashTable -Hashtable $EventFilter -Key "RecordID" -Value $RecordID Add-ToHashTable -Hashtable $EventFilter -Key "NamedDataFilter" -Value $NamedDataFilter Add-ToHashTable -Hashtable $EventFilter -Key "NamedDataExcludeFilter" -Value $NamedDataExcludeFilter Add-ToHashTable -Hashtable $EventFilter -Key "UserID" -Value $UserID Add-ToHashTable -Hashtable $EventFilter -Key "ExcludeID" -Value $ExcludeID [Array] $Param = foreach ($Comp in $Machine) { if ($Verbose) { Write-Verbose "Get-Events - Preparing data to scan computer $Comp" foreach ($Key in $EventFilter.Keys) { if ($Key -eq 'NamedDataFilter' -or $Key -eq 'NamedDataExcludeFilter') { foreach ($SubKey in $($EventFilter.$Key).Keys) { Write-Verbose "Get-Events - Filter parameters provided $Key with SubKey $SubKey = $(($EventFilter.$Key.$SubKey) -join ', ')" } } else { Write-Verbose "Get-Events - Filter parameters provided $Key = $(($EventFilter.$Key) -join ', ')" } } } if ($null -ne $ID) { # EventID needed $ID = $ID | Sort-Object -Unique Write-Verbose "Get-Events - Events to process in Total (unique): $($Id.Count)" Write-Verbose "Get-Events - Events to process in Total ID: $($ID -join ', ')" if ($Id.Count -gt 22) { Write-Verbose "Get-Events - There are more events to process then 22, split will be required." } $SplitArrayID = Split-Array -inArray $ID -size 22 # Support for more ID's then 22 (limitation of Get-WinEvent) foreach ($EventIdGroup in $SplitArrayID) { $EventFilter.Id = @($EventIdGroup) @{ Comp = $Comp EventFilter = $EventFilter.Clone() MaxEvents = $MaxEvents Oldest = $Oldest Verbose = $Verbose } } } else { # No EventID given @{ Comp = $Comp EventFilter = $EventFilter MaxEvents = $MaxEvents Oldest = $Oldest Verbose = $Verbose } } } if ($null -ne $Param) { $null = $ParametersList.AddRange($Param) } } $AllErrors = @() if ($DisableParallel) { Write-Verbose 'Get-Events - Running query with parallel disabled...' [Array] $AllEvents = foreach ($Param in $ParametersList) { Invoke-Command -ScriptBlock $Script:ScriptBlock -ArgumentList $Param.Comp, $Param.EventFilter, $Param.MaxEvents, $Param.Oldest, $Param.Verbose } } else { Write-Verbose 'Get-Events - Running query with parallel enabled...' $RunspacePool = New-Runspace -MaxRunspaces $maxRunspaces -Verbose:$Verbose $Runspaces = foreach ($Parameter in $ParametersList) { Start-Runspace -ScriptBlock $Script:ScriptBlock -Parameters $Parameter -RunspacePool $RunspacePool -Verbose:$Verbose } [Array] $AllEvents = Stop-Runspace -Runspaces $Runspaces -FunctionName "Get-Events" -RunspacePool $RunspacePool -Verbose:$Verbose -ErrorAction SilentlyContinue -ErrorVariable +AllErrors -ExtendedOutput:$ExtendedOutput } #$EventsProcessed = Get-ObjectCount -Object $AllEvents Write-Verbose "Get-Events - Overall errors: $($AllErrors.Count)" Write-Verbose "Get-Events - Overall events processed in total for the report: $($AllEvents.Count)" Write-Verbose "Get-Events - Overall time to generate $($MeasureTotal.Elapsed.Hours) hours, $($MeasureTotal.Elapsed.Minutes) minutes, $($MeasureTotal.Elapsed.Seconds) seconds, $($MeasureTotal.Elapsed.Milliseconds) milliseconds" $MeasureTotal.Stop() Write-Verbose "Get-Events - Overall events processing end" #if ($ExtendedOutput) { # return , $AllEvents # returns @{ Output and Errors } #} if ($AllEvents.Count -eq 1) { return , $AllEvents } else { return $AllEvents } } function Get-EventsFilter { <# .SYNOPSIS This function generates an xpath filter that can be used with the -FilterXPath parameter of Get-WinEvent. It may also be used inside the <Select></Select tags of a Custom View in Event Viewer. .DESCRIPTION This function generates an xpath filter that can be used with the -FilterXPath parameter of Get-WinEvent. It may also be used inside the <Select></Select tags of a Custom View in Event Viewer. This function allows for the create of xpath which can select events based on many properties of the event including those of named data nodes in the event's XML. XPath is case sensetive and the data passed to the parameters here must match the case of the data in the event's XML. .NOTES Original Code by https://community.spiceworks.com/scripts/show/3238-powershell-xpath-generator-for-windows-events Extended by Justin Grote Extended by Przemyslaw Klys .LINK .PARAMETER ID This parameter accepts and array of event ids to include in the xpath filter. .PARAMETER StartTime This parameter sets the oldest event that may be returned by the xpath. Please, note that the xpath time selector created here is based of of the time the xpath is generated. XPath uses a time difference method to select events by time; that time difference being the number of milliseconds between the time and now. .PARAMETER EndTime This parameter sets the newest event that may be returned by the xpath. Please, note that the xpath time selector created here is based of of the time the xpath is generated. XPath uses a time difference method to select events by time; that time difference being the number of milliseconds between the time and now. .PARAMETER Data This parameter will accept an array of values that may be found in the data section of the event's XML. .PARAMETER ProviderName This parameter will accept an array of values that select events from event providers. .PARAMETER Level This parameter will accept an array of values that specify the severity rating of the events to be returned. It accepts the following values. 'Critical', 'Error', 'Informational', 'LogAlways', 'Verbose', 'Warning' .PARAMETER Keywords This parameter accepts and array of long integer keywords. You must pass this parameter the long integer value of the keywords you want to search and not the keyword description. .PARAMETER UserID This parameter will accept an array of SIDs or domain accounts. .PARAMETER NamedDataFilter This parameter will accept and array of hashtables that define the key value pairs for which you want to filter against the event's named data fields. Key values, as with XPath filters, are case sensetive. You may assign an array as the value of any key. This will search for events where any of the values are present in that particular data field. If you wanted to define a filter that searches for a SubjectUserName of either john.doe or jane.doe, pass the following @{'SubjectUserName'=('john.doe','jane.doe')} You may specify multiple data files and values. Doing so will create an XPath filter that will only return results where both values are found. If you only wanted to return events where both the SubjectUserName is john.doe and the TargetUserName is jane.doe, then pass the following @{'SubjectUserName'='john.doe';'TargetUserName'='jane.doe'} You may pass an array of hash tables to create an 'or' XPath filter that will return objects where either key value set will be returned. If you wanted to define a filter that searches for either a SubjectUserName of john.doe or a TargetUserName of jane.doe then pass the following (@{'SubjectUserName'='john.doe'},@{'TargetUserName'='jane.doe'}) .EXAMPLE Get-EventsFilter -ID 4663 -NamedDataFilter @{'SubjectUserName'='john.doe'} -LogName 'ForwardedEvents' This will return an XPath filter that will return any events with the id of 4663 and has a SubjectUserName of 'john.doe' Output: <QueryList> <Query Id="0" Path="ForwardedEvents"> <Select Path="ForwardedEvents"> (*[System[EventID=4663]]) and (*[EventData[Data[@Name='SubjectUserName'] = 'john.doe']]) </Select> </Query> </QueryList> .EXAMPLE Get-EventsFilter -StartTime '1/1/2015 01:30:00 PM' -EndTime '1/1/2015 02:00:00 PM' -LogName 'ForwardedEvents This will return an XPath filter that will return events that occured between 1:30 2:00 PM on 1/1/2015. The filter will only be good if used immediately. XPath time filters are based on the number of milliseconds that have occured since the event and when the filter is used. StartTime and EndTime simply calculate the number of milliseconds and use that for the filter. Output: <QueryList> <Query Id="0" Path="ForwardedEvents"> <Select Path="ForwardedEvents"> (*[System[TimeCreated[timediff(@SystemTime) <= 125812885399]]]) and (*[System[TimeCreated[timediff(@SystemTime) >= 125811085399]]]) </Select> </Query> </QueryList> .EXAMPLE Get-EventsFilter -StartTime (Get-Date).AddDays(-1) -LogName System This will return an XPath filter that will get events that occured within the last 24 hours. Output: <QueryList> <Query Id="0" Path="System"> <Select Path="System"> *[System[TimeCreated[timediff(@SystemTime) <= 86404194]]] </Select> </Query> </QueryList> .EXAMPLE Get-EventsFilter -ID 1105 -LogName 'ForwardedEvents' -RecordID '3512231','3512232' This will return an XPath filter that will get events with EventRecordID 3512231 or 3512232 in Log ForwardedEvents with EventID 1105 Output: <QueryList> <Query Id="0" Path="ForwardedEvents"> <Select Path="ForwardedEvents"> (*[System[EventID=1105]]) and (*[System[(EventRecordID=3512231) or (EventRecordID=3512232)]]) </Select> </Query> </QueryList> #> [CmdletBinding()] Param ( [String[]] $ID, [alias('RecordID')][string[]] $EventRecordID, [DateTime] $StartTime, [DateTime] $EndTime, [String[]] $Data, [String[]] $ProviderName, [Long[]] $Keywords, [ValidateSet( 'Critical', 'Error', 'Informational', 'LogAlways', 'Verbose', 'Warning' )] [String[]] $Level, [String[]] $UserID, [Hashtable[]] $NamedDataFilter, [Hashtable[]] $NamedDataExcludeFilter, [String[]] $ExcludeID, [Parameter(Mandatory = $true)][String] $LogName, [switch] $XPathOnly ) #region Function definitions Function Join-XPathFilter { Param ( [Parameter( Mandatory = $True, Position = 0 )] [String] $NewFilter, [Parameter( Position = 1 )] [String] $ExistingFilter = '', [Parameter( Position = 2 )] # and and or are case sensitive # in xpath [ValidateSet( "and", "or", IgnoreCase = $False )] [String] $Logic = 'and', [switch]$NoParenthesis ) If ($ExistingFilter) { # If there is an existing filter add parenthesis unless noparenthesis is specified # and the logical operator if ($NoParenthesis) { Return "$ExistingFilter $Logic $NewFilter" } Else { Return "($ExistingFilter) $Logic ($NewFilter)" } } Else { Return $NewFilter } <# .SYNOPSIS This function handles the parenthesis and logical joining of XPath statements inside of Get-EventsFilter #> } Function Initialize-XPathFilter { Param ( [Object[]] $Items, [String] $ForEachFormatString, [String] $FinalizeFormatString, [switch]$NoParenthesis ) $filter = '' ForEach ($item in $Items) { $options = @{ 'NewFilter' = ($ForEachFormatString -f $item) 'ExistingFilter' = $filter 'Logic' = 'or' 'NoParenthesis' = $NoParenthesis } $filter = Join-XPathFilter @options } Return $FinalizeFormatString -f $filter <# .SYNOPSIS This function loops thru a set of items and injecting each item in the format string given by ForEachFormatString, then combines each of those items together with 'or' logic using the function Join-XPathFilter, which handles the joining and parenthesis. Before returning the result, it injects the resultant xpath into FinalizeFormatString. This function is a part of Get-EventsFilter #> } #endregion Function definitions [string] $filter = '' #region ID filter If ($ID) { $options = @{ 'Items' = $ID 'ForEachFormatString' = "EventID={0}" 'FinalizeFormatString' = "*[System[{0}]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion ID filter # region EventRecordID filter If ($EventRecordID) { $options = @{ 'Items' = $EventRecordID 'ForEachFormatString' = "EventRecordID={0}" 'FinalizeFormatString' = "*[System[{0}]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion EventRecordID filter #region Exclude ID filter If ($ExcludeID) { $options = @{ 'Items' = $ExcludeID 'ForEachFormatString' = "EventID!={0}" 'FinalizeFormatString' = "*[System[{0}]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion Exclude ID filter #region Date filters $Now = Get-Date # Time in XPath is filtered based on the number of milliseconds # between the creation of the event and when the XPath filter is # used. # # The timediff xpath function is used against the SystemTime # attribute of the TimeCreated node. ## Special chars needs replacement # <= is <= # < is < # > is > # >= is >= # If ($StartTime) { $Diff = [Math]::Round($Now.Subtract($StartTime).TotalMilliseconds) $filter = Join-XPathFilter -NewFilter "*[System[TimeCreated[timediff(@SystemTime) <= $Diff]]]" -ExistingFilter $filter } If ($EndTime) { $Diff = [Math]::Round($Now.Subtract($EndTime).TotalMilliseconds) $filter = Join-XPathFilter -NewFilter "*[System[TimeCreated[timediff(@SystemTime) >= $Diff]]]" -ExistingFilter $filter } #endregion Date filters #region Data filter If ($Data) { $options = @{ 'Items' = $Data 'ForEachFormatString' = "Data='{0}'" 'FinalizeFormatString' = "*[EventData[{0}]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion Data filter #region ProviderName filter If ($ProviderName) { $options = @{ 'Items' = $ProviderName 'ForEachFormatString' = "@Name='{0}'" 'FinalizeFormatString' = "*[System[Provider[{0}]]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion ProviderName filter #region Level filter If ($Level) { $levels = ForEach ($item in $Level) { # Levels in an event's XML are defined # with integer values. [Int][System.Diagnostics.Tracing.EventLevel]::$item } $options = @{ 'Items' = $levels 'ForEachFormatString' = "Level={0}" 'FinalizeFormatString' = "*[System[{0}]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion Level filter #region Keyword filter # Keywords are stored as a long integer # numeric value. That integer is the # flagged (binary) combination of # all the keywords. # # By combining all given keywords # with a binary OR operation, and then # taking the resultant number and # comparing that against the number # stored in the events XML with a # binary AND operation will return # events that have any of the submitted # keywords assigned. If ($Keywords) { $keyword_filter = '' ForEach ($item in $Keywords) { If ($keyword_filter) { $keyword_filter = $keyword_filter -bor $item } Else { $keyword_filter = $item } } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter "*[System[band(Keywords,$keyword_filter)]]" } #endregion Keyword filter #region UserID filter # The UserID attribute of the Security node contains a Sid. If ($UserID) { $sids = ForEach ($item in $UserID) { Try { #If the value submitted isn't a valid sid, it'll error. $sid = [System.Security.Principal.SecurityIdentifier]($item) $sid = $sid.Translate([System.Security.Principal.SecurityIdentifier]) } Catch [System.Management.Automation.RuntimeException] { # If a RuntimeException occured with an InvalidArgument category # attempt to create an NTAccount object and resolve. If ($Error[0].CategoryInfo.Category -eq 'InvalidArgument') { Try { $user = [System.Security.Principal.NTAccount]($item) $sid = $user.Translate([System.Security.Principal.SecurityIdentifier]) } Catch { #There was an error with either creating the NTAccount or #Translating that object to a sid. Throw $Error[0] } } Else { #There was a RuntimeException from either creating the #SecurityIdentifier object or the translation #and the category was not InvalidArgument Throw $Error[0] } } Catch { #There was an error from ether the creation of the SecurityIdentifier #object or the Translatation Throw $Error[0] } $sid.Value } $options = @{ 'Items' = $sids 'ForEachFormatString' = "@UserID='{0}'" 'FinalizeFormatString' = "*[System[Security[{0}]]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion UserID filter #region NamedDataFilter If ($NamedDataFilter) { $options = @{ 'Items' = $( # This will create set of datafilters for each of # the hash tables submitted in the hash table array ForEach ($item in $NamedDataFilter) { $options = @{ 'Items' = $( #This will result in as set of XPath subexpressions #for each key submitted in the hashtable ForEach ($key in $item.Keys) { If ($item[$key]) { #If there is a value for the key, create the #XPath for the Data node with that Name attribute #and value. Use 'and' logic to join the data values. #to the Name Attribute. $options = @{ 'Items' = $item[$key] 'NoParenthesis' = $true 'ForEachFormatString' = "'{0}'" 'FinalizeFormatString' = "Data[@Name='$key'] = {0}" } Initialize-XPathFilter @options } Else { #If there isn't a value for the key, create #XPath for the existence of the Data node with #that paritcular Name attribute. "Data[@Name='$key']" } } ) 'ForEachFormatString' = "{0}" 'FinalizeFormatString' = "{0}" } Initialize-XPathFilter @options } ) 'ForEachFormatString' = "{0}" 'FinalizeFormatString' = "*[EventData[{0}]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion NamedDataFilter #region NamedDataExcludeFilter If ($NamedDataExcludeFilter) { $options = @{ 'Items' = $( # This will create set of datafilters for each of # the hash tables submitted in the hash table array ForEach ($item in $NamedDataExcludeFilter) { $options = @{ 'Items' = $( #This will result in as set of XPath subexpressions #for each key submitted in the hashtable ForEach ($key in $item.Keys) { If ($item[$key]) { #If there is a value for the key, create the #XPath for the Data node with that Name attribute #and value. Use 'and' logic to join the data values. #to the Name Attribute. $options = @{ 'Items' = $item[$key] 'NoParenthesis' = $true 'ForEachFormatString' = "'{0}'" 'FinalizeFormatString' = "Data[@Name='$key'] != {0}" } Initialize-XPathFilter @options } Else { #If there isn't a value for the key, create #XPath for the existence of the Data node with #that paritcular Name attribute. "Data[@Name='$key']" } } ) 'ForEachFormatString' = "{0}" 'FinalizeFormatString' = "{0}" } Initialize-XPathFilter @options } ) 'ForEachFormatString' = "{0}" 'FinalizeFormatString' = "*[EventData[{0}]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion NamedDataExcludeFilter if ($XPathOnly) { return $Filter } else { $FilterXML = @" <QueryList> <Query Id="0" Path="$LogName"> <Select Path="$LogName"> $filter </Select> </Query> </QueryList> "@ return $FilterXML } # Return $filter } # Function Get-EventsFilter function Get-EventsInformation { <# .SYNOPSIS Small wrapper against Get-WinEvent providing easy way to gather statistics for Event Logs. .DESCRIPTION Small wrapper against Get-WinEvent providing easy way to gather statistics for Event Logs. It provides option to ask for multiple machines, multiple files at the same time. It runs on steroids (runspaces) which allows youto process everything at same time. This basically allows you to query 50 servers at same time and do it in finite way. .PARAMETER Machine ComputerName or Server you want to query. Takes an array of servers as well. .PARAMETER FilePath FilePath to Event Log file (with .EVTX). Takes an array of Event Log files. .PARAMETER LogName LogName such as Security or System. Works in conjuction with Machine (s). Default is Security. .PARAMETER MaxRunspaces Maximum number of runspaces running at same time. For optimum performance decide on your own. Default is 50. .EXAMPLE $Computer = 'EVO1','AD1','AD2' $LogName = 'Security' $Size = Get-EventsInformation -Computer $Computer -LogName $LogName $Size | ft -A Output: EventNewest EventOldest FileSize FileSizeCurrentGB FileSizeMaximumGB IsClassicLog IsEnabled IsLogFull LastAccessTime LastWriteTime ----------- ----------- -------- ----------------- ----------------- ------------ --------- --------- -------------- ------------- 28.12.2018 12:47:14 20.12.2018 19:29:57 110170112 0.1 GB 0.11 GB True True False 27.05.2018 14:18:36 28.12.2018 12:33:24 28.12.2018 12:46:51 26.12.2018 12:54:16 20975616 0.02 GB 0.02 GB True True False 28.12.2018 12:46:57 28.12.2018 12:46:57 .EXAMPLE Due to AD2 being down time to run is 22 seconds. This is actual timeout before letting it go. $Computers = 'EVO1', 'AD1', 'AD2' $LogName = 'Security' $EventLogsDirectory = Get-ChildItem -Path 'C:\MyEvents' $Size = Get-EventsInformation -FilePath $EventLogsDirectory.FullName -Computer $Computers -LogName 'Security' $Size | ft -a Output: VERBOSE: Get-EventsInformation - processing start VERBOSE: Get-EventsInformation - Setting up runspace for EVO1 VERBOSE: Get-EventsInformation - Setting up runspace for AD1 VERBOSE: Get-EventsInformation - Setting up runspace for AD2 VERBOSE: Get-EventsInformation - Setting up runspace for C:\MyEvents\Archive-Security-2018-08-21-23-49-19-424.evtx VERBOSE: Get-EventsInformation - Setting up runspace for C:\MyEvents\Archive-Security-2018-09-08-02-53-53-711.evtx VERBOSE: Get-EventsInformation - Setting up runspace for C:\MyEvents\Archive-Security-2018-09-14-22-13-07-710.evtx VERBOSE: Get-EventsInformation - Setting up runspace for C:\MyEvents\Archive-Security-2018-09-15-09-27-52-679.evtx VERBOSE: AD2 Reading Event Log (Security) size failed. Error occured: The RPC server is unavailable VERBOSE: Get-EventsInformation - processing end - 0 days, 0 hours, 0 minutes, 22 seconds, 648 milliseconds EventNewest EventOldest FileSize FileSizeCurrentGB FileSizeMaximumGB IsClassicLog IsEnabled IsLogFull LastAccessTime LastWriteTime ----------- ----------- -------- ----------------- ----------------- ------------ --------- --------- -------------- ------------- 28.12.2018 15:56:54 20.12.2018 19:29:57 111218688 0.1 GB 0.11 GB True True False 27.05.2018 14:18:36 28.12.2018 14:18:24 22.08.2018 01:48:57 11.08.2018 09:28:06 115740672 0.11 GB 0.11 GB False False False 16.09.2018 09:27:04 22.08.2018 01:49:20 08.09.2018 04:53:52 03.09.2018 23:50:15 115740672 0.11 GB 0.11 GB False False False 12.09.2018 13:18:25 08.09.2018 04:53:53 15.09.2018 00:13:06 08.09.2018 04:53:53 115740672 0.11 GB 0.11 GB False False False 15.09.2018 00:13:26 15.09.2018 00:13:08 15.09.2018 11:27:51 22.08.2018 01:49:20 115740672 0.11 GB 0.11 GB False False False 15.09.2018 11:28:13 15.09.2018 11:27:55 28.12.2018 15:56:56 26.12.2018 15:56:31 20975616 0.02 GB 0.02 GB True True False 28.12.2018 15:56:47 28.12.2018 15:56:47 .EXAMPLE $Computers = 'EVO1', 'AD1','AD1' $LogName = 'Security' $EventLogsDirectory = Get-ChildItem -Path 'C:\MyEvents' $Size = Get-EventsInformation -FilePath $EventLogsDirectory.FullName -Computer $Computers -LogName 'Security' -Verbose $Size | ft -a Source, EventNewest, EventOldest,FileSize, FileSizeCurrentGB, FileSizeMaximumGB, IsEnabled, IsLogFull, LastAccessTime, LastWriteTime Output: VERBOSE: Get-EventsInformation - processing start VERBOSE: Get-EventsInformation - Setting up runspace for EVO1 VERBOSE: Get-EventsInformation - Setting up runspace for AD1 VERBOSE: Get-EventsInformation - Setting up runspace for AD1 VERBOSE: Get-EventsInformation - Setting up runspace for C:\MyEvents\Archive-Security-2018-08-21-23-49-19-424.evtx VERBOSE: Get-EventsInformation - Setting up runspace for C:\MyEvents\Archive-Security-2018-09-08-02-53-53-711.evtx VERBOSE: Get-EventsInformation - Setting up runspace for C:\MyEvents\Archive-Security-2018-09-14-22-13-07-710.evtx VERBOSE: Get-EventsInformation - Setting up runspace for C:\MyEvents\Archive-Security-2018-09-15-09-27-52-679.evtx VERBOSE: Get-EventsInformation - processing end - 0 days, 0 hours, 0 minutes, 1 seconds, 739 milliseconds Source EventNewest EventOldest FileSize FileSizeCurrentGB FileSizeMaximumGB IsEnabled IsLogFull LastAccessTime LastWriteTime ------ ----------- ----------- -------- ----------------- ----------------- --------- --------- -------------- ------------- AD1 28.12.2018 15:59:22 20.12.2018 19:29:57 111218688 0.1 GB 0.11 GB True False 27.05.2018 14:18:36 28.12.2018 14:18:24 AD1 28.12.2018 15:59:22 20.12.2018 19:29:57 111218688 0.1 GB 0.11 GB True False 27.05.2018 14:18:36 28.12.2018 14:18:24 File 22.08.2018 01:48:57 11.08.2018 09:28:06 115740672 0.11 GB 0.11 GB False False 16.09.2018 09:27:04 22.08.2018 01:49:20 File 08.09.2018 04:53:52 03.09.2018 23:50:15 115740672 0.11 GB 0.11 GB False False 12.09.2018 13:18:25 08.09.2018 04:53:53 File 15.09.2018 00:13:06 08.09.2018 04:53:53 115740672 0.11 GB 0.11 GB False False 15.09.2018 00:13:26 15.09.2018 00:13:08 File 15.09.2018 11:27:51 22.08.2018 01:49:20 115740672 0.11 GB 0.11 GB False False 15.09.2018 11:28:13 15.09.2018 11:27:55 EVO1 28.12.2018 15:59:22 26.12.2018 15:56:31 20975616 0.02 GB 0.02 GB True False 28.12.2018 15:58:47 28.12.2018 15:58:47 .EXAMPLE $Computers = 'EVO1', 'AD1' $EventLogsDirectory = Get-ChildItem -Path 'C:\MyEvents' $Size = Get-EventsInformation -FilePath $EventLogsDirectory.FullName -Computer $Computers -LogName 'Security','System' -Verbose $Size | ft -a Source, EventNewest, EventOldest,FileSize, FileSizeCurrentGB, FileSizeMaximumGB, IsEnabled, IsLogFull, LastAccessTime, LastWriteTime, LogFilePath, LOgName VERBOSE: Get-EventsInformation - processing start VERBOSE: Get-EventsInformation - Setting up runspace for EVO1 VERBOSE: Get-EventsInformation - Setting up runspace for AD1 VERBOSE: Get-EventsInformation - Setting up runspace for C:\MyEvents\Archive-Security-2018-08-21-23-49-19-424.evtx VERBOSE: Get-EventsInformation - Setting up runspace for C:\MyEvents\Archive-Security-2018-09-08-02-53-53-711.evtx VERBOSE: Get-EventsInformation - Setting up runspace for C:\MyEvents\Archive-Security-2018-09-14-22-13-07-710.evtx VERBOSE: Get-EventsInformation - Setting up runspace for C:\MyEvents\Archive-Security-2018-09-15-09-27-52-679.evtx VERBOSE: Get-EventsInformation - processing end - 0 days, 0 hours, 0 minutes, 0 seconds, 137 milliseconds Source EventNewest EventOldest FileSize FileSizeCurrentGB FileSizeMaximumGB IsEnabled IsLogFull LastAccessTime LastWriteTime LogFilePath LogName ------ ----------- ----------- -------- ----------------- ----------------- --------- --------- -------------- ------------- ----------- ------- File 22.08.2018 01:48:57 11.08.2018 09:28:06 115740672 0.11 GB 0.11 GB False False 16.09.2018 09:27:04 22.08.2018 01:49:20 C:\MyEvents\Archive-Security-2018-08-21-23-49-19-424.evtx N/A File 08.09.2018 04:53:52 03.09.2018 23:50:15 115740672 0.11 GB 0.11 GB False False 12.09.2018 13:18:25 08.09.2018 04:53:53 C:\MyEvents\Archive-Security-2018-09-08-02-53-53-711.evtx N/A EVO1 28.12.2018 18:19:48 26.12.2018 17:27:30 20975616 0.02 GB 0.02 GB True False 28.12.2018 18:19:47 28.12.2018 18:19:47 %SystemRoot%\System32\Winevt\Logs\Security.evtx Security AD1 28.12.2018 18:20:01 20.12.2018 19:29:57 113315840 0.11 GB 0.11 GB True False 27.05.2018 14:18:36 28.12.2018 17:48:24 %SystemRoot%\System32\Winevt\Logs\Security.evtx Security File 15.09.2018 00:13:06 08.09.2018 04:53:53 115740672 0.11 GB 0.11 GB False False 15.09.2018 00:13:26 15.09.2018 00:13:08 C:\MyEvents\Archive-Security-2018-09-14-22-13-07-710.evtx N/A EVO1 28.12.2018 18:20:01 05.10.2018 01:33:48 12652544 0.01 GB 0.02 GB True False 28.12.2018 18:18:01 28.12.2018 18:18:01 %SystemRoot%\System32\Winevt\Logs\System.evtx System AD1 28.12.2018 18:12:47 03.12.2018 17:20:48 2166784 0 GB 0.01 GB True False 19.05.2018 20:05:07 27.12.2018 12:00:32 %SystemRoot%\System32\Winevt\Logs\System.evtx System File 15.09.2018 11:27:51 22.08.2018 01:49:20 115740672 0.11 GB 0.11 GB False False 15.09.2018 11:28:13 15.09.2018 11:27:55 C:\MyEvents\Archive-Security-2018-09-15-09-27-52-679.evtx N/A .NOTES General notes #> [CmdLetBinding()] param( [alias ("ADDomainControllers", "DomainController", "Server", "Servers", "Computer", "Computers", "ComputerName")] [string[]] $Machine, [string[]] $FilePath, [alias ("LogType", "Log")][string[]] $LogName = 'Security', [int] $MaxRunspaces = 50, [alias('AskDC', 'QueryDomainControllers', 'AskForest')][switch] $RunAgainstDC ) Write-Verbose "Get-EventsInformation - processing start" if ($PSCmdlet.MyInvocation.BoundParameters["Verbose"].IsPresent) { $Verbose = $true } else { $Verbose = $false } $Time = Start-TimeLog $Pool = New-Runspace -MaxRunspaces $maxRunspaces -Verbose:$Verbose if ($RunAgainstDC) { Write-Verbose 'Get-EventsInformation - scanning for domain controllers' $ForestInformation = Get-WinADForestControllers $MachineWithErrors = $ForestInformation | Where-Object { $_.HostName -eq '' } foreach ($Computer in $MachineWithErrors) { Write-Warning "Get-EventsInformation - Error scanning forest $($Computer.Forest) (domain: $($Computer.Domain)) error: $($Computer.Comment)" } $Machine = ($ForestInformation | Where-Object { $_.HostName -ne '' }).HostName } $RunSpaces = @( foreach ($Computer in $Machine) { foreach ($Log in $LogName) { Write-Verbose "Get-EventsInformation - Setting up runspace for $Computer on $Log log" $Parameters = [ordered] @{ Computer = $Computer LogName = $Log Verbose = $Verbose } # returns values Start-Runspace -ScriptBlock $Script:ScriptBlockEventsInformation -Parameters $Parameters -RunspacePool $Pool -Verbose:$Verbose } } foreach ($Path in $FilePath) { Write-Verbose "Get-EventsInformation - Setting up runspace for $Path" $Parameters = [ordered] @{ Path = $Path Verbose = $Verbose } # returns values Start-Runspace -ScriptBlock $Script:ScriptBlockEventsInformation -Parameters $Parameters -RunspacePool $Pool -Verbose:$Verbose } ) ### End Runspaces START $AllEvents = Stop-Runspace -Runspaces $RunSpaces ` -FunctionName "Get-EventsInformation" ` -RunspacePool $pool -Verbose:$Verbose ` -ErrorAction SilentlyContinue ` -ErrorVariable +AllErrors foreach ($Error in $AllErrors) { Write-Warning "Get-EventsInformation - Error: $Error" } $Elapsed = Stop-TimeLog -Time $Time -Option OneLiner Write-Verbose -Message "Get-EventsInformation - processing end - $Elapsed" ### End Runspaces END return $AllEvents } Add-Type -TypeDefinition @" using System; namespace PSEventViewer { public enum Keywords : long { AuditFailure = (long) 4503599627370496, AuditSuccess = (long) 9007199254740992, CorrelationHint2 = (long) 18014398509481984, EventLogClassic = (long) 36028797018963968, Sqm = (long) 2251799813685248, WdiDiagnostic = (long) 1125899906842624, WdiContext = (long) 562949953421312, ResponseTime = (long) 281474976710656, None = (long) 0 } } "@ Add-Type -TypeDefinition @" using System; namespace PSEventViewer { public enum Level { Verbose = 5, Informational = 4, Warning = 3, Error = 2, Critical = 1, LogAlways = 0 } } "@ $Script:ScriptBlock = { Param ( [string]$Comp, [hashtable]$EventFilter, [int]$MaxEvents, [bool] $Oldest, [bool] $Verbose ) if ($Verbose) { $VerbosePreference = 'continue' } function Get-EventsFilter { <# .SYNOPSIS This function generates an xpath filter that can be used with the -FilterXPath parameter of Get-WinEvent. It may also be used inside the <Select></Select tags of a Custom View in Event Viewer. .DESCRIPTION This function generates an xpath filter that can be used with the -FilterXPath parameter of Get-WinEvent. It may also be used inside the <Select></Select tags of a Custom View in Event Viewer. This function allows for the create of xpath which can select events based on many properties of the event including those of named data nodes in the event's XML. XPath is case sensetive and the data passed to the parameters here must match the case of the data in the event's XML. .NOTES Original Code by https://community.spiceworks.com/scripts/show/3238-powershell-xpath-generator-for-windows-events Extended by Justin Grote Extended by Przemyslaw Klys .LINK .PARAMETER ID This parameter accepts and array of event ids to include in the xpath filter. .PARAMETER StartTime This parameter sets the oldest event that may be returned by the xpath. Please, note that the xpath time selector created here is based of of the time the xpath is generated. XPath uses a time difference method to select events by time; that time difference being the number of milliseconds between the time and now. .PARAMETER EndTime This parameter sets the newest event that may be returned by the xpath. Please, note that the xpath time selector created here is based of of the time the xpath is generated. XPath uses a time difference method to select events by time; that time difference being the number of milliseconds between the time and now. .PARAMETER Data This parameter will accept an array of values that may be found in the data section of the event's XML. .PARAMETER ProviderName This parameter will accept an array of values that select events from event providers. .PARAMETER Level This parameter will accept an array of values that specify the severity rating of the events to be returned. It accepts the following values. 'Critical', 'Error', 'Informational', 'LogAlways', 'Verbose', 'Warning' .PARAMETER Keywords This parameter accepts and array of long integer keywords. You must pass this parameter the long integer value of the keywords you want to search and not the keyword description. .PARAMETER UserID This parameter will accept an array of SIDs or domain accounts. .PARAMETER NamedDataFilter This parameter will accept and array of hashtables that define the key value pairs for which you want to filter against the event's named data fields. Key values, as with XPath filters, are case sensetive. You may assign an array as the value of any key. This will search for events where any of the values are present in that particular data field. If you wanted to define a filter that searches for a SubjectUserName of either john.doe or jane.doe, pass the following @{'SubjectUserName'=('john.doe','jane.doe')} You may specify multiple data files and values. Doing so will create an XPath filter that will only return results where both values are found. If you only wanted to return events where both the SubjectUserName is john.doe and the TargetUserName is jane.doe, then pass the following @{'SubjectUserName'='john.doe';'TargetUserName'='jane.doe'} You may pass an array of hash tables to create an 'or' XPath filter that will return objects where either key value set will be returned. If you wanted to define a filter that searches for either a SubjectUserName of john.doe or a TargetUserName of jane.doe then pass the following .PARAMETER XPathOnly This is switch. If used only XPATH filter is returned. Otherwise full XML. (@{'SubjectUserName'='john.doe'},@{'TargetUserName'='jane.doe'}) .EXAMPLE Get-EventsFilter -ID 4663 -NamedDataFilter @{'SubjectUserName'='john.doe'} -LogName 'ForwardedEvents' This will return an XPath filter that will return any events with the id of 4663 and has a SubjectUserName of 'john.doe' Output: <QueryList> <Query Id="0" Path="ForwardedEvents"> <Select Path="ForwardedEvents"> (*[System[EventID=4663]]) and (*[EventData[Data[@Name='SubjectUserName'] = 'john.doe']]) </Select> </Query> </QueryList> .EXAMPLE Get-EventsFilter -StartTime '1/1/2015 01:30:00 PM' -EndTime '1/1/2015 02:00:00 PM' -LogName 'ForwardedEvents This will return an XPath filter that will return events that occured between 1:30 2:00 PM on 1/1/2015. The filter will only be good if used immediately. XPath time filters are based on the number of milliseconds that have occured since the event and when the filter is used. StartTime and EndTime simply calculate the number of milliseconds and use that for the filter. Output: <QueryList> <Query Id="0" Path="ForwardedEvents"> <Select Path="ForwardedEvents"> (*[System[TimeCreated[timediff(@SystemTime) <= 125812885399]]]) and (*[System[TimeCreated[timediff(@SystemTime) >= 125811085399]]]) </Select> </Query> </QueryList> .EXAMPLE Get-EventsFilter -StartTime (Get-Date).AddDays(-1) -LogName System This will return an XPath filter that will get events that occured within the last 24 hours. Output: <QueryList> <Query Id="0" Path="System"> <Select Path="System"> *[System[TimeCreated[timediff(@SystemTime) <= 86404194]]] </Select> </Query> </QueryList> .EXAMPLE Get-EventsFilter -ID 1105 -LogName 'ForwardedEvents' -RecordID '3512231','3512232' This will return an XPath filter that will get events with EventRecordID 3512231 or 3512232 in Log ForwardedEvents with EventID 1105 Output: <QueryList> <Query Id="0" Path="ForwardedEvents"> <Select Path="ForwardedEvents"> (*[System[EventID=1105]]) and (*[System[(EventRecordID=3512231) or (EventRecordID=3512232)]]) </Select> </Query> </QueryList> #> [CmdletBinding()] Param ( [String[]] $ID, [alias('RecordID')][string[]] $EventRecordID, [DateTime] $StartTime, [DateTime] $EndTime, [String[]] $Data, [String[]] $ProviderName, [Long[]] $Keywords, [ValidateSet( 'Critical', 'Error', 'Informational', 'LogAlways', 'Verbose', 'Warning' )] [String[]] $Level, [String[]] $UserID, [Hashtable[]] $NamedDataFilter, [Hashtable[]] $NamedDataExcludeFilter, [String[]] $ExcludeID, [Parameter(Mandatory = $true)][String] $LogName ) #region Function definitions Function Join-XPathFilter { Param ( [Parameter( Mandatory = $True, Position = 0 )] [String] $NewFilter, [Parameter( Position = 1 )] [String] $ExistingFilter = '', [Parameter( Position = 2 )] # and and or are case sensitive # in xpath [ValidateSet( "and", "or", IgnoreCase = $False )] [String] $Logic = 'and', [switch]$NoParenthesis ) If ($ExistingFilter) { # If there is an existing filter add parenthesis unless noparenthesis is specified # and the logical operator if ($NoParenthesis) { Return "$ExistingFilter $Logic $NewFilter" } Else { Return "($ExistingFilter) $Logic ($NewFilter)" } } Else { Return $NewFilter } <# .SYNOPSIS This function handles the parenthesis and logical joining of XPath statements inside of Get-EventsFilter #> } Function Initialize-XPathFilter { Param ( [Object[]] $Items, [String] $ForEachFormatString, [String] $FinalizeFormatString, [switch]$NoParenthesis ) $filter = '' ForEach ($item in $Items) { $options = @{ 'NewFilter' = ($ForEachFormatString -f $item) 'ExistingFilter' = $filter 'Logic' = 'or' 'NoParenthesis' = $NoParenthesis } $filter = Join-XPathFilter @options } Return $FinalizeFormatString -f $filter <# .SYNOPSIS This function loops thru a set of items and injecting each item in the format string given by ForEachFormatString, then combines each of those items together with 'or' logic using the function Join-XPathFilter, which handles the joining and parenthesis. Before returning the result, it injects the resultant xpath into FinalizeFormatString. This function is a part of Get-EventsFilter #> } #endregion Function definitions [string] $filter = '' #region ID filter If ($ID) { $options = @{ 'Items' = $ID 'ForEachFormatString' = "EventID={0}" 'FinalizeFormatString' = "*[System[{0}]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion ID filter # region EventRecordID filter If ($EventRecordID) { $options = @{ 'Items' = $EventRecordID 'ForEachFormatString' = "EventRecordID={0}" 'FinalizeFormatString' = "*[System[{0}]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion EventRecordID filter #region Exclude ID filter If ($ExcludeID) { $options = @{ 'Items' = $ExcludeID 'ForEachFormatString' = "EventID!={0}" 'FinalizeFormatString' = "*[System[{0}]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion Exclude ID filter #region Date filters $Now = Get-Date # Time in XPath is filtered based on the number of milliseconds # between the creation of the event and when the XPath filter is # used. # # The timediff xpath function is used against the SystemTime # attribute of the TimeCreated node. ## Special chars needs replacement # <= is <= # < is < # > is > # >= is >= # If ($StartTime) { $Diff = [Math]::Round($Now.Subtract($StartTime).TotalMilliseconds) $filter = Join-XPathFilter -NewFilter "*[System[TimeCreated[timediff(@SystemTime) <= $Diff]]]" -ExistingFilter $filter } If ($EndTime) { $Diff = [Math]::Round($Now.Subtract($EndTime).TotalMilliseconds) $filter = Join-XPathFilter -NewFilter "*[System[TimeCreated[timediff(@SystemTime) >= $Diff]]]" -ExistingFilter $filter } #endregion Date filters #region Data filter If ($Data) { $options = @{ 'Items' = $Data 'ForEachFormatString' = "Data='{0}'" 'FinalizeFormatString' = "*[EventData[{0}]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion Data filter #region ProviderName filter If ($ProviderName) { $options = @{ 'Items' = $ProviderName 'ForEachFormatString' = "@Name='{0}'" 'FinalizeFormatString' = "*[System[Provider[{0}]]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion ProviderName filter #region Level filter If ($Level) { $levels = ForEach ($item in $Level) { # Levels in an event's XML are defined # with integer values. [Int][System.Diagnostics.Tracing.EventLevel]::$item } $options = @{ 'Items' = $levels 'ForEachFormatString' = "Level={0}" 'FinalizeFormatString' = "*[System[{0}]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion Level filter #region Keyword filter # Keywords are stored as a long integer # numeric value. That integer is the # flagged (binary) combination of # all the keywords. # # By combining all given keywords # with a binary OR operation, and then # taking the resultant number and # comparing that against the number # stored in the events XML with a # binary AND operation will return # events that have any of the submitted # keywords assigned. If ($Keywords) { $keyword_filter = '' ForEach ($item in $Keywords) { If ($keyword_filter) { $keyword_filter = $keyword_filter -bor $item } Else { $keyword_filter = $item } } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter "*[System[band(Keywords,$keyword_filter)]]" } #endregion Keyword filter #region UserID filter # The UserID attribute of the Security node contains a Sid. If ($UserID) { $sids = ForEach ($item in $UserID) { Try { #If the value submitted isn't a valid sid, it'll error. $sid = [System.Security.Principal.SecurityIdentifier]($item) $sid = $sid.Translate([System.Security.Principal.SecurityIdentifier]) } Catch [System.Management.Automation.RuntimeException] { # If a RuntimeException occured with an InvalidArgument category # attempt to create an NTAccount object and resolve. If ($Error[0].CategoryInfo.Category -eq 'InvalidArgument') { Try { $user = [System.Security.Principal.NTAccount]($item) $sid = $user.Translate([System.Security.Principal.SecurityIdentifier]) } Catch { #There was an error with either creating the NTAccount or #Translating that object to a sid. Throw $Error[0] } } Else { #There was a RuntimeException from either creating the #SecurityIdentifier object or the translation #and the category was not InvalidArgument Throw $Error[0] } } Catch { #There was an error from ether the creation of the SecurityIdentifier #object or the Translatation Throw $Error[0] } $sid.Value } $options = @{ 'Items' = $sids 'ForEachFormatString' = "@UserID='{0}'" 'FinalizeFormatString' = "*[System[Security[{0}]]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion UserID filter #region NamedDataFilter If ($NamedDataFilter) { $options = @{ 'Items' = $( # This will create set of datafilters for each of # the hash tables submitted in the hash table array ForEach ($item in $NamedDataFilter) { $options = @{ 'Items' = $( #This will result in as set of XPath subexpressions #for each key submitted in the hashtable ForEach ($key in $item.Keys) { If ($item[$key]) { #If there is a value for the key, create the #XPath for the Data node with that Name attribute #and value. Use 'and' logic to join the data values. #to the Name Attribute. $options = @{ 'Items' = $item[$key] 'NoParenthesis' = $true 'ForEachFormatString' = "'{0}'" 'FinalizeFormatString' = "Data[@Name='$key'] = {0}" } Initialize-XPathFilter @options } Else { #If there isn't a value for the key, create #XPath for the existence of the Data node with #that paritcular Name attribute. "Data[@Name='$key']" } } ) 'ForEachFormatString' = "{0}" 'FinalizeFormatString' = "{0}" } Initialize-XPathFilter @options } ) 'ForEachFormatString' = "{0}" 'FinalizeFormatString' = "*[EventData[{0}]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion NamedDataFilter #region NamedDataExcludeFilter If ($NamedDataExcludeFilter) { $options = @{ 'Items' = $( # This will create set of datafilters for each of # the hash tables submitted in the hash table array ForEach ($item in $NamedDataExcludeFilter) { $options = @{ 'Items' = $( #This will result in as set of XPath subexpressions #for each key submitted in the hashtable ForEach ($key in $item.Keys) { If ($item[$key]) { #If there is a value for the key, create the #XPath for the Data node with that Name attribute #and value. Use 'and' logic to join the data values. #to the Name Attribute. $options = @{ 'Items' = $item[$key] 'NoParenthesis' = $true 'ForEachFormatString' = "'{0}'" 'FinalizeFormatString' = "Data[@Name='$key'] != {0}" } Initialize-XPathFilter @options } Else { #If there isn't a value for the key, create #XPath for the existence of the Data node with #that paritcular Name attribute. "Data[@Name='$key']" } } ) 'ForEachFormatString' = "{0}" 'FinalizeFormatString' = "{0}" } Initialize-XPathFilter @options } ) 'ForEachFormatString' = "{0}" 'FinalizeFormatString' = "*[EventData[{0}]]" } $filter = Join-XPathFilter -ExistingFilter $filter -NewFilter (Initialize-XPathFilter @options) } #endregion NamedDataExcludeFilter $FilterXML = @" <QueryList> <Query Id="0" Path="$LogName"> <Select Path="$LogName"> $filter </Select> </Query> </QueryList> "@ return $FilterXML # Return $filter } # Function Get-EventsFilter function Get-EventsInternal () { [CmdLetBinding()] param ( [string]$Comp, [hashtable]$EventFilter, [int]$MaxEvents, [switch] $Oldest ) Write-Verbose "Get-Events - Inside $Comp for Events ID: $($EventFilter.ID)" Write-Verbose "Get-Events - Inside $Comp for Events LogName: $($EventFilter.LogName)" Write-Verbose "Get-Events - Inside $Comp for Events RecordID: $($EventFilter.RecordID)" Write-Verbose "Get-Events - Inside $Comp for Events Oldest: $Oldest" Write-Verbose "Get-Events - Inside $Comp for Events Max Events: $MaxEvents" $Measure = [System.Diagnostics.Stopwatch]::StartNew() # Timer Start try { $Events = @( if ($null -ne $EventFilter.RecordID -or ` $null -ne $EventFilter.NamedDataFilter -or ` $null -ne $EventFilter.ExcludeID -or ` $null -ne $EventFilter.NamedDataExcludeFilter -or ` $null -ne $EventFilter.UserID ) { $FilterXML = Get-EventsFilter @EventFilter Write-Verbose "Get-Events - Inside $Comp - Custom FilterXML: `n$FilterXML" if ($MaxEvents -ne $null -and $MaxEvents -ne 0) { Get-WinEvent -FilterXml $FilterXML -ComputerName $Comp -MaxEvents $MaxEvents -Oldest:$Oldest -ErrorAction Stop } else { Get-WinEvent -FilterXml $FilterXML -ComputerName $Comp -Oldest:$Oldest -ErrorAction Stop } } else { foreach ($k in $EventFilter.Keys) { Write-Verbose "Get-Events - Inside $Comp Data in FilterHashTable $k $($EventFilter[$k])" } if ($MaxEvents -ne 0) { Get-WinEvent -FilterHashtable $EventFilter -ComputerName $Comp -MaxEvents $MaxEvents -Oldest:$Oldest -ErrorAction Stop } else { Get-WinEvent -FilterHashtable $EventFilter -ComputerName $Comp -Oldest:$Oldest -ErrorAction Stop } } ) $EventsCount = ($Events | Measure-Object).Count Write-Verbose -Message "Get-Events - Inside $Comp Events found $EventsCount" } catch { if ($_.Exception -match "No events were found that match the specified selection criteria") { Write-Verbose -Message "Get-Events - Inside $Comp No events found." } elseif ($_.Exception -match "There are no more endpoints available from the endpoint") { Write-Verbose -Message "Get-Events - Inside $Comp Error $($_.Exception.Message)" Write-Error -Message "$Comp`: $_" } else { Write-Verbose -Message "Get-Events - Inside $Comp Error $($_.Exception.Message)" Write-Error -Message "$Comp`: $_" } Write-Verbose "Get-Events - Inside $Comp Time to generate $($Measure.Elapsed.Hours) hours, $($Measure.Elapsed.Minutes) minutes, $($Measure.Elapsed.Seconds) seconds, $($Measure.Elapsed.Milliseconds) milliseconds" $Measure.Stop() return } Write-Verbose "Get-Events - Inside $Comp Processing events..." # Parse out the event message data ForEach ($Event in $Events) { # Convert the event to XML $eventXML = [xml]$Event.ToXml() # Iterate through each one of the XML message properties Add-Member -InputObject $Event -MemberType NoteProperty -Name "Computer" -Value $event.MachineName.ToString() -Force Add-Member -InputObject $Event -MemberType NoteProperty -Name "Date" -Value $Event.TimeCreated -Force $EventTopNodes = Get-Member -InputObject $eventXML.Event -MemberType Properties | Where-Object { $_.Name -ne 'System' -and $_.Name -ne 'xmlns'} foreach ($EventTopNode in $EventTopNodes) { $TopNode = $EventTopNode.Name $EventSubsSubs = Get-Member -InputObject $eventXML.Event.$TopNode -Membertype Properties $h = 0 foreach ($EventSubSub in $EventSubsSubs) { $SubNode = $EventSubSub.Name #$EventSubSub | ft -a if ($EventSubSub.Definition -like "System.Object*") { if (Get-Member -InputObject $eventXML.Event.$TopNode -name "$SubNode" -Membertype Properties) { # Case 1 $SubSubNode = Get-Member -InputObject $eventXML.Event.$TopNode.$SubNode -MemberType Properties | Where-Object { $_.Name -ne 'xmlns' -and $_.Definition -like "string*" } foreach ($Name in $SubSubNode.Name) { $fieldName = $Name $fieldValue = $eventXML.Event.$TopNode.$SubNode.$Name Add-Member -InputObject $Event -MemberType NoteProperty -Name $fieldName -Value $fieldValue -Force } # Case 1 For ($i = 0; $i -lt $eventXML.Event.$TopNode.$SubNode.Count; $i++) { if (Get-Member -InputObject $eventXML.Event.$TopNode.$SubNode[$i] -name "Name" -Membertype Properties) { # Case 2 $fieldName = $eventXML.Event.$TopNode.$SubNode[$i].Name if (Get-Member -InputObject $eventXML.Event.$TopNode.$SubNode[$i] -name "#text" -Membertype Properties) { $fieldValue = $eventXML.Event.$TopNode.$SubNode[$i]."#text" if ($fieldValue -eq "-".Trim()) { $fieldValue = $fieldValue -replace "-" } } else { $fieldValue = "" } if ($fieldName -ne "") { Add-Member -InputObject $Event -MemberType NoteProperty -Name $fieldName -Value $fieldValue -Force } # Case 2 } else { # Case 3 $Value = $eventXML.Event.$TopNode.$SubNode[$i] if ($Value.Name -ne 'Name' -and $Value.Name -ne '#text') { $fieldName = "NoNameA$i" $fieldValue = $Value Add-Member -InputObject $Event -MemberType NoteProperty -Name $fieldName -Value $fieldValue -Force } # Case 3 } } } } elseif ($EventSubSub.Definition -like "System.Xml.XmlElement*") { # Case 1 $SubSubNode = Get-Member -InputObject $eventXML.Event.$TopNode.$SubNode -MemberType Properties | Where-Object { $_.Name -ne 'xmlns' -and $_.Definition -like "string*" } foreach ($Name in $SubSubNode.Name) { $fieldName = $Name $fieldValue = $eventXML.Event.$TopNode.$SubNode.$Name Add-Member -InputObject $Event -MemberType NoteProperty -Name $fieldName -Value $fieldValue -Force } # Case 1 } else { # Case 4 - Where Data has no Names $fieldValue = $eventXML.Event.$TopNode.$SubNode if ($fieldValue -match "\n") { # this is case with ADConnect - event id 6946 where 1 Value has multiple values line per line $SplittedValues = $fieldValue -split '\n' foreach ($Split in $SplittedValues) { $h++ $fieldName = "NoNameB$h" Add-Member -InputObject $Event -MemberType NoteProperty -Name $fieldName -Value $Split -Force } } else { $h++ $fieldName = "NoNameB$h" Add-Member -InputObject $Event -MemberType NoteProperty -Name $fieldName -Value $fieldValue -Force } # Case 4 } } } # This adds some fields specific to PSWinReporting [string] $MessageSubject = ($Event.Message -split '\n')[0] Add-Member -InputObject $Event -MemberType NoteProperty -Name 'MessageSubject' -Value $MessageSubject -Force Add-Member -InputObject $Event -MemberType NoteProperty -Name 'Action' -Value $MessageSubject -Force # Level value is not needed because there is actually LevelDisplayName #Add-Member -InputObject $Event -MemberType NoteProperty -Name 'LevelTranslated' -Value ([PSEventViewer.Level] $Event.Level) # Overwrite value - the old value is collection Add-Member -InputObject $Event -MemberType NoteProperty -Name 'KeywordDisplayName' -Value ($Event.KeywordsDisplayNames -join ',') -Force if ($Event.SubjectDomainName -and $Event.SubjectUserName) { Add-Member -InputObject $Event -MemberType NoteProperty -Name 'Who' -Value "$($Event.SubjectDomainName)\$($Event.SubjectUserName)" -Force } if ($Event.TargetDomainName -and $Event.TargetUserName) { Add-Member -InputObject $Event -MemberType NoteProperty -Name 'ObjectAffected' -Value "$($Event.TargetDomainName)\$($Event.TargetUserName)" -Force } if ($Event.MemberName) { [string] $MemberNameWithoutCN = $Event.MemberName -replace 'CN=|\\|,(OU|DC|CN).*$' Add-Member -InputObject $Event -MemberType NoteProperty -Name 'MemberNameWithoutCN' -Value $MemberNameWithoutCN -Force } } Write-Verbose "Get-Events - Inside $Comp Time to generate $($Measure.Elapsed.Hours) hours, $($Measure.Elapsed.Minutes) minutes, $($Measure.Elapsed.Seconds) seconds, $($Measure.Elapsed.Milliseconds) milliseconds" $Measure.Stop() return $Events } Write-Verbose "Get-Events -------------START---------------------" $Data = Get-EventsInternal -Comp $Comp -EventFilter $EventFilter -MaxEvents $MaxEvents -Oldest:$Oldest -Verbose:$Verbose if ($EventFilter.Path) { $Data | Add-Member -MemberType NoteProperty -Name "GatheredFrom" -Value $EventFilter.Path -Force } else { $Data | Add-Member -MemberType NoteProperty -Name "GatheredFrom" -Value $Comp -Force } $Data | Add-Member -MemberType NoteProperty -Name "GatheredLogName" -Value $EventFilter.LogName -Force Write-Verbose "Get-Events --------------END----------------------" return $Data } $Script:ScriptBlockEventsInformation = { Param ( [string]$Computer, [string]$Path, [string]$LogName, [bool] $Verbose ) if ($Verbose) { $VerbosePreference = 'continue' } function Convert-Size { # Original - https://techibee.com/powershell/convert-from-any-to-any-bytes-kb-mb-gb-tb-using-powershell/2376 # # Changelog - Modified 30.03.2018 - przemyslaw.klys at evotec.pl # - Added $Display Switch [cmdletbinding()] param( [validateset("Bytes", "KB", "MB", "GB", "TB")] [string]$From, [validateset("Bytes", "KB", "MB", "GB", "TB")] [string]$To, [Parameter(Mandatory = $true)] [double]$Value, [int]$Precision = 4, [switch]$Display ) switch ($From) { "Bytes" {$value = $Value } "KB" {$value = $Value * 1024 } "MB" {$value = $Value * 1024 * 1024} "GB" {$value = $Value * 1024 * 1024 * 1024} "TB" {$value = $Value * 1024 * 1024 * 1024 * 1024} } switch ($To) { "Bytes" {return $value} "KB" {$Value = $Value / 1KB} "MB" {$Value = $Value / 1MB} "GB" {$Value = $Value / 1GB} "TB" {$Value = $Value / 1TB} } if ($Display) { return "$([Math]::Round($value,$Precision,[MidPointRounding]::AwayFromZero)) $To" } else { return [Math]::Round($value, $Precision, [MidPointRounding]::AwayFromZero) } } try { if ($Computer -eq '') { $FileInformation = Get-ChildItem -File $Path $EventsOldest = Get-WinEvent -MaxEvents 1 -Oldest -Path $Path -Verbose:$false $EventsNewest = Get-WinEvent -MaxEvents 1 -Path $Path -Verbose:$false $RecordCount = $EventsNewest.RecordID - $EventsOldest.RecordID $EventsInfo = [PSCustomObject]@{ EventNewest = $EventsNewest.TimeCreated EventOldest = $EventsOldest.TimeCreated FileSize = $FileInformation.Length FileSizeCurrentGB = Convert-Size -Value $FileInformation.Length -From Bytes -To GB -Precision 2 -Display FileSizeMaximumGB = Convert-Size -Value $FileInformation.Length -From Bytes -To GB -Precision 2 -Display IsClassicLog = $false IsEnabled = $false IsLogFull = $false LastAccessTime = $FileInformation.LastAccessTime LastWriteTime = $FileInformation.LastWriteTime LogFilePath = $Path LogIsolation = $false LogMode = 'N/A' LogName = 'N/A' LogType = 'N/A' MaximumSizeInBytes = $FileInformation.Length MachineName = (@($EventsOldest.MachineName) + @($EventsNewest.MachineName) | Sort-Object -Unique) -join ', ' OldestRecordNumber = $EventsOldest.RecordID OwningProviderName = '' ProviderBufferSize = 0 ProviderControlGuid = '' ProviderKeywords = '' ProviderLatency = 1000 ProviderLevel = '' ProviderMaximumNumberOfBuffers = 16 ProviderMinimumNumberOfBuffers = 0 ProviderNames = '' ProviderNamesExpanded = '' RecordCount = $RecordCount SecurityDescriptor = '' Source = 'File' } } else { $EventsInfo = Get-WinEvent -ListLog $LogName -ComputerName $Computer $FileSizeCurrentGB = Convert-Size -Value $EventsInfo.FileSize -From Bytes -To GB -Precision 2 -Display $FileSizeMaximumGB = Convert-Size -Value $EventsInfo.MaximumSizeInBytes -From Bytes -To GB -Precision 2 -Display $EventOldest = (Get-WinEvent -MaxEvents 1 -LogName $LogName -Oldest -ComputerName $Computer).TimeCreated $EventNewest = (Get-WinEvent -MaxEvents 1 -LogName $LogName -ComputerName $Computer).TimeCreated $ProviderNamesExpanded = $EventsInfo.ProviderNames -join ', ' Add-Member -InputObject $EventsInfo -MemberType NoteProperty -Name "FileSizeCurrentGB" -Value $FileSizeCurrentGB -Force Add-Member -InputObject $EventsInfo -MemberType NoteProperty -Name "FileSizeMaximumGB" -Value $FileSizeMaximumGB -Force Add-Member -InputObject $EventsInfo -MemberType NoteProperty -Name "EventOldest" -Value $EventOldest -Force Add-Member -InputObject $EventsInfo -MemberType NoteProperty -Name "EventNewest" -Value $EventNewest -Force Add-Member -InputObject $EventsInfo -MemberType NoteProperty -Name "ProviderNamesExpanded" -Value $ProviderNamesExpanded -Force Add-Member -InputObject $EventsInfo -MemberType NoteProperty -Name "MachineName" -Value $Computer -Force Add-Member -InputObject $EventsInfo -MemberType NoteProperty -Name "Source" -Value $Computer -Force } } catch { $ErrorMessage = $_.Exception.Message -replace "`n", " " -replace "`r", " " switch ($ErrorMessage) { {$_ -match 'No events were found'} { Write-Verbose -Message "$Computer Reading Event Log ($LogName) size failed. No events found." } {$_ -match 'Attempted to perform an unauthorized operation'} { Write-Verbose -Message "$Computer Reading Event Log ($LogName) size failed. Unauthorized operation." Write-Error -Message "$Computer`: $_" } default { Write-Verbose -Message "$Computer Reading Event Log ($LogName) size failed. Error occured: $ErrorMessage" Write-Error -Message "$Computer`: $_" } } } $Properties = $EventsInfo.PSObject.Properties.Name | Sort-Object $EventsInfo | Select-Object $Properties } Export-ModuleMember ` -Function @('Get-Events','Get-EventsFilter','Get-EventsInformation') ` -Alias @() |