Can anyone help me fix these 2-3 poweshell lines?

spiceuser-m64cd · 2022-04-08T03:35:52.000Z

Guys, can anyone tell me what I’m doing wrong here?

The issue I’m having is with getting the computername, date, making it a folder. And then copying the event logs to that folder.

these commands generate the computer name and the folder of the day this script is ran.

$computerName = $env:computername

$weeklyAudit = (Get-Date).tostring(“MM-MM-yyyy”) + (" - ") + $computerName

New-Item -itemType Directory -Path "c:\temp" -Name $weeklyAudit

log commands

$logFileName1 = “Application”

$logFileName2 = “System”

$logFileName3 = “Security”

#$logFileName4 = “Setup”

$path = "C:\temp" # Add Path, needs to end with a backsplash

do not edit

$exportFileName1 = $logFileName1 + (get-date -f yyyyMMdd) + “.evt”

$exportFileName2 = $logFileName2 + (get-date -f yyyyMMdd) + “.evt”

$exportFileName3 = $logFileName3 + (get-date -f yyyyMMdd) + “.evt”

#$exportFileName4 = $logFileName4 + (get-date -f yyyyMMdd) + “.evt”

$logFile1 = Get-WmiObject Win32_NTEventlogFile | Where-Object {$_.logfilename -eq $logFileName1}

$logFile2 = Get-WmiObject Win32_NTEventlogFile | Where-Object {$_.logfilename -eq $logFileName2}

$logFile3 = Get-WmiObject Win32_NTEventlogFile | Where-Object {$_.logfilename -eq $logFileName3}

#$logFile4 = Get-WmiObject Win32_NTEventlogFile | Where-Object {$_.logfilename -eq $logFileName4}

#The Following commands export the data

$logFile1.backupeventlog($path + $exportFileName1)

$logFile2.backupeventlog($path + $exportFileName2)

$logFile3.backupeventlog($path + $exportFileName3)

#$logFile4.backupeventlog($path + $exportFileName4)

#Clear-EventLog -LogName system,system,security

Neally · 2022-04-08T03:43:22.000Z

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don't say "Need help" or "PowerShell Help", actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy, past…

192033ab-bb8f-4032-88a5-8e2313af0344-codebutton_small.png

Neally Bot

peter-ere · 2022-04-08T06:58:01.000Z

When you get the day, you have an issue with your format, you format it to “MM-MM-yyyy”, don’t you want the day somwhere instead of one of the 2 MM ?

saidbrandon · 2022-04-08T10:04:14.000Z

In addition to what Peter-Ere said, I would also add that you’re calling Get-Date many times and you aren’t need second or subsecond granularity. Just call it once at the beginning of the script and then use that variable as needed. i.e.

$Today = Get-Date
$StartTime = Get-Date
$Now = Get-Date
$Date = Get-Date

Name the variable with what makes sense for your script. Above are the most common I use (only one). That way if I need to make decisions on what $variable is, for example: if ($Today.DayOfWeek -eq “Friday”) I can. When outputting to a file, I’ll just format the date at that point.

$exportFileName1 = "$logFileName1 $($Today.ToString("yyyyMMdd")).evt"

Additionally, and not related, it’s better to create a single string rather than concatenating with plus signs. I would also look into Get-CimInstance as it’s replaced the now deprecated Get-WMIObject as it’s faster and you can create a single session and run multiple queries versus your code that does both 4 times.

spiceuser-m64cd · 2022-04-08T10:16:25.000Z

@peter-ere

Yes, thank you for catching that mistake.

gary-m-g · 2022-04-08T10:43:23.000Z

My suggestion is NOT to make a folder per script run day.

Instead, create ONE folder per hostname.
Then, rename the event logs you capture as Hostname_type_yyyyMMddhhmm.evtx
where type is Application, System or Security.
Store them in their host’s folder.

My structure is:
Year
Domain
Servers
Windows
Linux
Workstations
Windows
Linux

Hosts’ folders, by type, go in their respective hierarchy.

When auditors come to review your security posture, this organized structure will serve you better as it provides an easily inspectable environment.
When you or your team need to review the logs, it’s easier.
Don’t forget—the parent folder for all the logs should have auditing turned on and auditing shall be Full Control for Everyone with Success and Failure.

Those are the NIST, DISA, and STIG requirements.

spiceuser-m64cd · 2022-04-08T10:50:24.000Z

Additionally, and not related, it’s better to create a single string rather than concatenating with plus signs. I would also look into Get-CimInstance as it’s replaced the now deprecated Get-WMIObject as it’s faster and you can create a single session and run multiple queries versus your code that does both 4 times.

** @saidbrandon **

I think I understand the context of what you are telling me but I don’t have the expertise to digest it fully. I will need to better learn the syntax options of Get-CimInstance to understand how to get it to pull the information I need. The lines I have come from Google. And by the way your suggestion about the date variable worked for me thank you!

gary-m-g · 2022-04-08T10:56:34.000Z

I believe the extension you want is “evtx”

This probably came from an old script when event logs were still evt’s.

For some reason my above post lost the formatting for the hierarchies.

Year is a parent folder for each major hierarchy.

Domains per year are nested Servers and workstations are the next level

Within each, major OS Types are segregated.

saidbrandon · 2022-04-08T12:21:44.000Z

Here’s an updated version that follows the DRY (Don’t Repeat Yourself) principle of development of your original post. I also added a few checks and balances and wrapped it as a function so you can call it in different ways without changing any code i.e.

Get-SystemLogs
Get-SystemLogs -ComputerName "SERVER1"
Get-SystemLogs -ComputerName "SERVER1","SERVER2"
Get-SystemLogs -ComputerName "SERVER1" -Log "Application","System","Security"

Hopefully it’s easier for you to understand and make any / all of the changes you see fit that Gary mentioned. I also wrapped it into a function so you can call it on any computer

function Get-SystemLogs {
    param (
        [string[]]$ComputerName = $env:COMPUTERNAME,
        [string[]]$Log = @("Application", "System", "Security", "Setup")
    )

    begin {
        $Today = Get-Date
        $ComputerName | ForEach-Object {
            $CurrentComputer = $_
            $LogFolder = "$($Today.ToString("MM-dd-yyyy")) - $_"
            if (-not (Test-Path -Path "C:\Temp\$LogFolder")) {
                New-Item -ItemType Directory -Path "C:\Temp\" -Name $LogFolder | Out-Null
            }
            try {
                $Log | ForEach-Object {
                    $PipelineVariable = $_
                    $Events = Get-WmiObject Win32_NTEventlogFile | Where-Object {$_.LogFileName -eq $PipelineVariable}
                    if ($null -ne $Events) {
                        $Events.BackupEventlog("C:\Temp\$LogFolder\$PipelineVariable$($Today.ToString("yyyyMMdd")).evt") | Out-Null
                    }
                    Clear-EventLog -ComputerName $CurrentComputer -LogName $_ -WhatIf
                }
            } catch {
                Write-Error $_.Exception.Message -ErrorAction Continue
            }
        }
    }
}

You’re iterating each computer and within that each log name.

gary-m-g · 2022-04-08T16:54:42.000Z

Don’t forget: EVTX.
You probably don’t want EVTs.

scouts · 2022-04-11T02:07:35.000Z

I don’t follow why you are going through the pain of gathering Event Logs. If you need it for regulatory or accreditation like my work place requires it for CJIS then you really need a system that specializes in event log collection. If it’s for simple review then might I suggest something like my health check script, https://community.spiceworks.com/scripts/show/5030-environment-health-checker