如何解决无法解析Get-WinEvent消息正文?
我需要根据以下Win-Event查询显示IP地址和主机名的方法:
脚本:
$date = Get-date -Format "dd-MM_hh_mm"
$FilePath = ([Environment]::GetFolderPath("Desktop") + "\DCOMErrors_$date.txt")
Clear-Host
Write-Host "`r`nGathering DCOM ID:10028 errors from $env:computername system"
$DCOM = Get-WinEvent System | Where-Object { ($_.ProviderName -like "Microsoft-Windows-distributedCOM") -and ($_.ID -like "10028") }
Write-Host "`r`nProcessing DCOM messages"
$DCOMHash = New-Object "System.Collections.Generic.List[System.Object]"
$DCOM | ForEach-Object -Process {
$DCOMfr = $DCOMline.Message.IndexOf("computer",1)
$DCOMto = $DCOMline.message.IndexOf("using")
$DCOMip = ""
$DCOMip = $DCOMline.message.substring($DCOMfr + 9,$DCOMto - $DCOMfr - 9)
$DCOMhostname = If ([System.Net.Dns]::GetHostEntry($DCOMip)) { [System.Net.Dns]::GetHostEntry($DCOMip) } else { try { [System.Net.Dns]::GetHostEntry($DCOMip) } catch { $_.Exception.Message } }
$DCOMhash += $DCOMip -replace '\.$'
}
Out-File -filepath
"Total DCOM Error Count: " + $DCOMhash.count | Export-Csv -FilePath $FilePath -Append
$DCOMhash | group-object | sort-object Count -Descending | Format-Table -Property Name,Count | Out-File -FilePath $FilePath -Append
Write-Host "Result of the script to gather the IPs with DCOM errors associated with them `r`n There is Now a text file on the desktop with the output,opening txt file in"
ii $FilePath
上面的尝试没有产生如下面结果样本中那样有意义的结果
当前输出:
Total DCOM Error Count: 1000
Name Count
---- -----
1000
预期结果:
> Total DCOM Error Count: 1000
> Name Hostname Count
> ---- -------- -----
> 1.1.1.1 AD01 400
> 1.1.2.2 AD02 300
> 2.2.2.2 N/A 500
如果需要,这是事件ID 10028的以下示例:
Log Name: System
Source: Microsoft-Windows-distributedCOM
Date: 27/10/2020 12:57:25 PM
Event ID: 10028
Task Category: None
Level: Error
Keywords: Classic
User: SYstem
Computer: MON01.server-farm.com
Description:
DCOM was unable to communicate with the computer 1.1.1.1 using any of the configured protocols; requested by PID 61a0 (C:\Program Files (x86)\Common Files\SolarWinds\JobEngine.v2\SWJobEngineWorker2x64.exe).
> Event Xml: <Event
> xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
> <System>
> <Provider Name="Microsoft-Windows-distributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM"
> />
> <EventID Qualifiers="0">10028</EventID>
> <Version>0</Version>
> <Level>2</Level>
> <Task>0</Task>
> <Opcode>0</Opcode>
> <Keywords>0x8080000000000000</Keywords>
> <TimeCreated SystemTime="2020-10-27T01:57:25.776635700Z" />
> <EventRecordID>72256491</EventRecordID>
> <Correlation />
> <Execution ProcessID="976" ThreadID="9500" />
> <Channel>System</Channel>
> <Computer>MON01.server-farm.com</Computer>
> <Security UserID="S-1-5-18" /> </System> <EventData>
> <Data Name="param1">10.10.5.165</Data>
> <Data Name="param2"> 61a0</Data>
> <Data Name="param3">C:\Program Files (x86)\Common Files\SolarWinds\JobEngine.v2\SWJobEngineWorker2x64.exe</Data>
> <Binary>12934761728346172846987569874562345ABCDEF</Binary> </EventData> </Event>
解决方法
在此脚本中,您遇到了几个问题。
首先,您要提取所有系统日志,然后进行过滤,这将会很慢。任何过滤器选项(filterhashtable,filterxpath,filterxml)都可以极大地加快这一步。
第二,您正在运行Foreach-Object
循环,但是在应引用$DCOMline
时引用了一些随机变量名$_
第三,DCOMhostname试图填充,但从此不再使用。整个部分似乎都被误导了。如果成功或失败,则每个“名称”将运行GetHostEntry两次。还发现$DCOMip
末尾有多余的空间,导致GetHostEntry对所有对象均失败。
第四,随机Out-File -filepath
第五,尝试将文本“ Total DCOM Error Count:” + $ DCOMhash.count导出为CSV。似乎要在此处使用“设置/添加内容”。
第六,Format-Table
仅应用于控制台输出,而不应用于管道或写入文件。
第七,当Out-File
似乎是导出CSV的适当位置时使用
第八,您似乎试图对名称进行分组,但也希望在输出中获取主机名。您也可以将其添加到group-object -property,但是如果每种名称都有很多不同的主机名,则只会列出其中之一。
所有这些,这将为您获取名称(ip)和计数,以及$DCOMash
变量中的名称和主机名。
$date = Get-date -Format "dd-MM_hh_mm"
$FilePath = ([Environment]::GetFolderPath("Desktop") + "\DCOMErrors_$date.txt")
Clear-Host
Write-Host "`r`nGathering DCOM ID:10028 errors from $env:computername system"
$DCOM = Get-WinEvent -FilterHashtable @{
LogName = 'System'
ProviderName = "Microsoft-Windows-DistributedCOM"
ID = "10028"
}
Write-Host "`r`nProcessing DCOM messages"
$DCOMHash = New-Object "System.Collections.Generic.List[System.Object]"
$DCOM | ForEach-Object -Process {
$DCOMfr = $_.Message.IndexOf("computer",1)
$DCOMto = $_.message.IndexOf("using")
$DCOMip = ""
$DCOMip = $_.message.substring($DCOMfr + 9,$DCOMto - $DCOMfr - 9).trim()
try
{
$DCOMhostname = [System.Net.Dns]::GetHostEntry($DCOMip).hostname -replace '\.$'
}
catch
{
$DCOMhostname = "N/A"
}
$DCOMhash.Add([PSCustomObject]@{
Name = $DCOMip
HostName = $DCOMhostname
})
}
$DCOMhash | Group-Object -Property name | select name,count | Sort-Object Count -Descending
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。