Powershell please help - to all the mind reader out there :-))

mrpeppa · 2021-01-14T14:38:07.000Z

I want to exclude some particular Events by mentioning the eventID.

The code below gives me administrative events which is ok. The only thing I want to extend is a part where I can exclude particular events.

 $result = Get-WinEvent -ErrorAction stop -Credential $credential -ComputerName $Computer -filterh @{LogName=(Get-WinEvent -Computername $Computer -ListLog *| ? {($_.logtype -eq 'administrative') -and ($_.eventID -NotMatch 8001)} | ? recordcount).logname;StartTime=$starttime;Level=1,2} | select machinename,timecreated,providername,logname,id,leveldisplayname,message

Neally · 2021-01-14T14:49:57.000Z

MrPeppa:

-and ($_.eventID -NotMatch 8001)

maybe try

get-winevent | where-object {$_.eventid -ne "1234"}

DoctorDNS · 2021-01-14T14:51:11.000Z

You can always pipe the get command wo a where-object cmdlet to drop those events you do not want.

Neally · 2021-01-14T14:51:49.000Z

Also I see you already asked this:

https://community.spiceworks.com/topic/2302961-powershell-i-want-to-exclude-some-particular-eventids

No need to re-post.

DoctorDNS · 2021-01-14T14:53:04.000Z

That earlier post is gone.

jitensh · 2021-01-14T15:10:30.000Z

you can

#multiple 
{($_.eventID -NotMatch '8001|83483|383|842985')}
 or
  where {{$_.EventID -ne 1704} -or {$_.EventID -ne 1312}}
 Or
#exclude by message, include by events
 where {{$_.EventID -ne 1704} -or {$_.EventID -ne 1312 -and $_.message -notcontains "*software protection*"}}

Neally · 2021-01-14T15:26:07.000Z

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don't say "Need help" or "PowerShell Help", actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy, past…

DoctorDNS · 2021-01-14T15:30:46.000Z

MrPeppa:

another badly formatted resonse

I hate to have to resort to going public, but this user seems to have a comprehension issue.

I have explained that you can not just post some code and ask a question like this. You should be, and have been told at least three times, formatting the code properly. You are now in moderation. I will give you till I finish my cup of tea to fix that post before I will remove it. for the fourth (fifth?) time.

We love to help and want to assist you. But you are not making it easy.

My apologies if this seems like a rant, It probably is. But please read what was sent to you and learn how to ask better questions.

mrpeppa · 2021-01-14T15:34:41.000Z

Can not enter code. It has a bug. Not my fault!!

DoctorDNS · 2021-01-14T16:32:43.000Z

MrPeppa:

Can not enter code. It has a bug. Not my fault!!

Use the </> tool., it works well

Get-Help "How to use Spiceworks and get better answers"

For example?

mrpeppa · 2021-01-15T13:25:22.000Z

Where would you put the exclusion with where-object…

Process
        {

        foreach($Computer in $ComputerName) {
    
            $Result = $Null

            write-verbose "$(Get-Date) - Working on $Computer - Eventlog"

            $starttime = (Get-Date).Addminutes(-$MinutesBack)
    
            try {

                write-verbose "$(Get-Date) - Trying with Get-WinEvent"
    
                $result = Get-WinEvent -ErrorAction stop -Credential $credential -ComputerName $Computer -filterh @{LogName=(Get-WinEvent -Computername $Computer -ListLog *| ? {($_.logtype -eq 'administrative') -and ($_.eventID -NotMatch 8001)} | ? recordcount).logname;StartTime=$starttime;Level=1,2} | select machinename,timecreated,providername,logname,id,leveldisplayname,message

DoctorDNS · 2021-01-15T18:23:32.000Z

You already have one in the code, although you do use the alias ? Instead of the full cmdlet name.
Just extend it to filter out the events you do not want.

mrpeppa · 2021-01-18T06:50:09.000Z

The one in the code is not working. I still get errors with the Event ID 8001.