Quantcast
Channel: Symantec Connect - ブログエントリ
Viewing all articles
Browse latest Browse all 5094

[PowerShell] Monitor Event Logs

$
0
0

I have always wondered if there is a good way to tail the Windows event log. (like $tail -f /var/log/messages)

I can get the contents of the Event Log by "Get-EventLog" command but I have to run the command each time.
Of course I can loop like this but it is not easy to follow.

While ( 1 ) {
	    Clear-Host
	    Get-EventLog 'Symantec Enterprise Vault' -Newest 10
	    Sleep 1
	}

The solution for me was to register against the EntryWritten Event in EventLog Class.

Everytime a new Event is raised, it shows up in your PowerShell window.

20140919_105712.jpg

First, we get the event log that we are interested.

$EVLOG = Get-EventLog -List | Where-Object {$_.Log -eq 'Symantec Enterprise Vault'}

Then register the event EntryWritten with the Action of writing the contents of the event to the console with Write-Host command.

Register-ObjectEvent -InputObject $EVLOG -EventName EntryWritten -SourceIdentifier EVEventLogEntry -Action{

	Write-Host $event.SourceEventArgs.Entry.TimeWritten.ToString("MM/d HH:mm:ss")  `
	           $event.SourceEventArgs.Entry.EventID  `
	           $event.SourceEventArgs.Entry.Category  `
	           $event.SourceEventArgs.Entry.Message.SubString(0,35) `
	-Separator " : " `
	-ForegroundColor white `
	-BackgroundColor black
	}

If you are not interested anymore, you can unregister this way or just simply close the PowerShell window and restart a new window.

Unregister-Event EVEventLogEntry

 


Viewing all articles
Browse latest Browse all 5094

Trending Articles