[PowerShell每日技巧]根据日期时间查看事件日志(20140309)

DAIC

Often, you might want to browse all system events around a given date. Let's say a machine crashed at 08:47, and you'd like to see all events +/? 2 minutes around that time.

Here is a script that does It for you:

1. $deltaminutes = 2
   
2. $delta = New-TimeSpan -Minutes $deltaminutes
   
3. 
   
4. $time = Read-Host -Prompt 'Enter time of event (yyyy-MM-dd HH:mm:ss or HH:mm)'
   
5. 
   
6. $datetime = Get-Date -Date $time
   
7. $start = $datetime - $delta
   
8. $end = $datetime + $delta
   
9. 
   
10. $result = @(Get-EventLog -LogName System -Before $end -After $start)
    
11. $result += Get-EventLog -LogName Application -Before $end -After $start
    
12. 
    
13. $result | Sort-Object -Property TimeGenerated -Descending |
    
14.   Out-GridView -Title "Events +/? $deltaminutes minutes around $datetime"

复制代码

When you run it, it asks for a time or a date and time. Next, you get back all events that occurred within 2 minutes before and after in the system and application log.

http://powershell.com/cs/blogs/tips/archive/2014/03/09/finding-events-around-a-date.aspx