Skip to main content

How to Use Date/Time Information From Custom Logs in PowerShell. Part 1 of 2.

By

PowerShell offers us some neat tools to help reduce our coding. In Part I, we are going to look at how to extract date/time information from the Windows event logs and do date/time math. In part II, we will look at how to use date/information from a third party log and utilize the same date/time methods that PowerShell offers us from the Windows logs.

Let’s look at the format that time is given to us in PowerShell.

Get-Date


Now, let’s look at how date/time data is represented from using the Get-EventLog cmdlet. We will be gathering data from the Application log for the demonstration.


Notice that we are provided the month in a thee character format. The day is present but not the year. The hour and minutes are in a 24 hour format. Let’s put the output of the event log into a variable.

$A = Get-EventLog “Application”

Note, this may take a few minutes. Once completed, we are going to determine the last event in the log. Since the objects of the event log are now stored in the array $A we can use the Count property to determine the upper limit of the array.

$a.Count


This array has 45,948 records from the application log (Remember, arrays start at zero but the counter starts at 1). Since these are objects, they have properties that we can work with.

$A[45948] | GM –MemberType Property


Now take a look at the TimeGenerated Property.

$A[45948].TimeGenerated


It is already in the same format as the output of the Get-Time command. Now the question comes, how do we find the difference between the two dates? Easy, we use the built in methods of PowerShell. Execute this line:

$Today = GetDate

Now that the current date/time information is stored in a variable, we can take a look at the methods available to us.

$Today | GM –MemberType Methods


Of interest to us is the Subtract method. Since the TimeGenerated property of the log file is already of the correct format, we can simple execute the following line of code:

$Today.Subtract($a[45948].TimeGenerated)


We can see the Date/Time difference. This is telling us how long ago this log entry was generated.

Next Tuesday, we are going to take a look at how to due this when your date/time information is coming from a third party log.



Labels:

Comments

Post a Comment

Popular posts from this blog

How to list all the AD LDS instances on a server

By
AD LDS allows you to provide directory services to applications that are free of the confines of Active Directory.  To list all the AD LDS instances on a server, follow this procedure: Log into the server in question Open a command prompt. Type dsdbutil and press Enter Type List Instances and press Enter . You will receive a list of the instance name, both the LDAP and SSL port numbers, the location of the database, and its status.
Post a Comment
Read more

How to run GPResult on a remote client with PowerShell

By
In the past, to run the GPResult command, you would need to either physically visit this client, have the user do it, or use and RDP connection.  In all cases, this will disrupt the user.  First, you need PowerShell remoting enabled on the target machine.  You can do this via Group Policy . Open PowerShell and type this command. Invoke-Command –ScriptBlock {GPResult /r} –ComputerName <ComputerName> Replace <ComputerName> with the name of the target.  Remember, the target needs to be online and accessible to you.
Post a Comment
Read more

Error icon when creating a GPO Preference drive map

By
You may not have an error at all.  Take a look at the drive mapping below. The red triangle is what threw us off.  It is not an error.  It is simply a color representation of the Replace option of the Action field in the properties of the drive mappings. Create action This give you a green triangle. The Create action creates a new mapped drive for users. Replace Action The Replace action gives you a red triangle.  This action will delete and recreate mapped drives for users. The net result of the Replace action is to overwrite all existing settings associated with the mapped drive. If the drive mapping does not exist, then the Replace action creates a new drive mapping. Update Action The Update action will have a yellow triangle. Update will modify settings of an existing mapped drive for users. This action differs from Replace in that it only updates settings defined within the preference item. All other settings remain as configured on the ma...
1 comment
Read more