I am having issues getting this really handy script to sort right by using events that have happened in the last day or so. How would I need to sort out the lastwrite comment to filter out the dates first so I don't iterate all of the previous days events? Any help would be greatly appreciated!
I have added the get-date variables and the lastwrite like the author suggested but when I try to run an filter for the and statement I get no return on event IDs even though they exist in the log.
$Now = Get-Date
$lastWrite = $Now.AddDays(-1)
-and($_.TimeWritten -ge $lastWrite)
====================CODE==============================
#
# Microsoft PowerShell Source File
#
# NAME: EvtLogReader.ps1
#
# AUTHOR: Jesse Hamrick
# DATE : 11/5/2008
# Web :
www.powershellpro.com #
# ==================================================
# EvtLogReader.ps1 script converted into a Function
Function EvtReader {
#Connect to Computer Security Event Log.
$logs = [System.Diagnostics.EventLog]::GetEventLogs(’servername’)
$colItems = $logs[9].entries
foreach ($item in $colItems){
if(($item.EventID -eq 4728)-or($item.EventID -eq 4729)-or`
($item.EventID -eq 4732)-or($item.EventID -eq 4737)-or`
($item.EventID -eq 4733)-or($item.EventID -eq 4735)){
“DC Reporting : ” + $item.MachineName
“Event ID: ” + $item.EventID
“Time Written: ” + $item.TimeWritten
“Category: ” + $item.Category
“Entry Type: ” + $item.EntryType
“UserName: ” + $item.UserName
“Data: ” + $item.Data
“Source: ” + $item.Source
“Time Generated: ” + $item.TimeGenerated
“Message: ” + $item.Message
“====================================================”
” ”
}
}
}
# ====================================================
# Create new .NET object and assign to variable
$mail = New-Object System.Net.Mail.MailMessage
# Set the addresses (FROM:)
$mail.From = New-Object System.Net.Mail.MailAddress(”username@domain.com”);
# Set the Recipient Address (TO:)
$mail.To.Add(”user.name@domain.com”);
# Email Subject
$mail.Subject = “DC Security Logs”;
# Message Body - Call Function Here
$mail.Body = EvtReader;
# Connect to your mail server
$smtp = new-object System.Net.Mail.SmtpClient(”server@domain.com”);
# Uncomment line below if authentication is required
# $smtp.Credentials = New-Object System.Net.NetworkCredential(”username”, “passwd”);
# Send Mail
$smtp.Send($mail);