Exclude specified event ids from Get-WinEvent output.

albertsantos2 · 2016-12-20T00:42:11.000Z

Hello there. Looking at my code below, what’s the best possible way to exclude specific events from the CSS output generated? What i want is for the script to fetch the list of event ids to be excluded from a text file. Sorry, i really am a beginner in this.

$computers = 'Servers.txt'
$StartDate = (get-date).AddDays(-1)
$logReport = "D:\LogReport\LogReport.html"

$css= "<style>"
$css= $css+ "BODY{ text-align: center; background-color:white;}"
$css= $css+ "TABLE{    font-family: 'Lucida Sans Unicode', 'Lucida Grande', Sans-Serif;font-size: 12px;margin: 10px;width: 100%;text-align: center;border-collapse: collapse;border-top: 7px solid #004466;border-bottom: 7px solid #004466;}"
$css= $css+ "TH{font-size: 13px;font-weight: normal;padding: 1px;background: #cceeff;border-right: 1px solid #004466;border-left: 1px solid #004466;color: #004466;}"
$css= $css+ "TD{padding: 1px;background: ##FFFFFF;border-right: 1px solid #004466;border-left: 1px solid #004466;color: #669;hover:black;}"
$css= $css+  "TD:hover{ background-color:#e5f7ff;}"
$css= $css+ "</style>" 

$body = Get-Content $computers | ForEach-Object {
    Get-WinEvent -ComputerName $_ -FilterHashtable @{logname=System; Level=1,2,3; starttime=$StartDate} 

$body | ConvertTo-HTML -Head $css MachineName,LogName,LevelDisplayName,ID,TimeCreated,Message > $logReport

@powershellman8045

dwren · 2016-12-20T13:11:49.000Z

First thought I had was a Case statement that does nothing for the event IDs you want to ignore.

tonyorr · 2016-12-22T12:20:21.000Z

I am not 100% sure of what you are trying to acheive, but you could use an if statement to poulate only the CSS code only with the values of relevence:

I had a quick play around and came up with the below:

$computers = 'C:\Path to servers txt file\Servers.txt'
$StartDate = (get-date).AddDays(-1)
$logReport = "D:\LogReport\LogReport.html"
$OutputStream = @()

$css= "<style>"
$css= $css+ "BODY{ text-align: center; background-color:white;}"
$css= $css+ "TABLE{    font-family: 'Lucida Sans Unicode', 'Lucida Grande', Sans-Serif;font-size: 12px;margin: 10px;width: 100%;text-align: center;border-collapse: collapse;border-top: 7px solid #004466;border-bottom: 7px solid #004466;}"
$css= $css+ "TH{font-size: 13px;font-weight: normal;padding: 1px;background: #cceeff;border-right: 1px solid #004466;border-left: 1px solid #004466;color: #004466;}"
$css= $css+ "TD{padding: 1px;background: ##FFFFFF;border-right: 1px solid #004466;border-left: 1px solid #004466;color: #669;hover:black;}"
$css= $css+  "TD:hover{ background-color:#e5f7ff;}"
$css= $css+ "</style>" 

$body = Get-Content $computers 

$Body | ForEach {

$Test = Get-WinEvent -ComputerName $_ -FilterHashtable @{logname='System'; starttime=$StartDate}

Foreach ($event in $test) {

$CurrentId = $event.Id

if ($CurrentId -ne '7036' ) {

$outputstream += $Event

}

}

}

$OutputStream | ConvertTo-HTML -Head $css MachineName,LogName,LevelDisplayName,ID,TimeCreated,Message > $logReport

Note that you will need to put the full path of the servers.txt in your $computers variable. The if statment has a ‘-ne’ operator for Not Equals, so it will pull any event that does not equal that particular EventId. But you should be able to change this to either -eq for equals or even have a couple linked together i.e. if (($CurrentId -ne ‘7036’) -or ($CurrentId -ne ‘7016’) )

Just test it in a controlled test setting first i.e. a test server and see if it works the way you want.

tonyorr · 2016-12-22T12:21:35.000Z

I also had to remove the Level=1,2,3 part out of your Get-WinEvent entry as it was not working for me

albertsantos2 · 2016-12-23T03:12:29.000Z

Hello Tony. This is great. I will test this out and will let you know how it goes.

doughnutdestroyer · 2016-12-27T20:09:19.000Z

albertsantos2:

Hello Tony. This is great. I will test this out and will let you know how it goes.

Did that workout for you?

albertsantos2 · 2017-01-03T06:59:18.000Z

Tony7172:

But you should be able to change this to either -eq for equals or even have a couple linked together i.e. if (($CurrentId -ne ‘7036’) -or ($CurrentId -ne ‘7016’) )

Hi Tony,

It works on a single EventID but having a couple of EventIDs linked together does not work. i.e. if (($CurrentId -ne ‘7036’) -or ($CurrentId -ne ‘7016’) ).

albertsantos2 · 2017-01-03T07:01:03.000Z

Doughnut Destroyer:

albertsantos2:

Hello Tony. This is great. I will test this out and will let you know how it goes.

Did that workout for you?

It did, for a single eventid. Linking 2 or more eventid does not work.

tonyorr · 2017-01-03T12:38:49.000Z

I have had a quick look and may have been overcomplicating it a bit.

Try using the following format for the if statement (replace the EventIds with the ones you want to omit):

if (($CurrentId -ne ‘7036’) -and ($CurrentId -ne ‘7016’)).

albertsantos2 · 2017-01-03T23:17:39.000Z

Tony7172:

I have had a quick look and may have been overcomplicating it a bit.

Try using the following format for the if statement (replace the EventIds with the ones you want to omit):

if (($CurrentId -ne ‘7036’) -and ($CurrentId -ne ‘7016’)).

Hey man. This works! Thanks heaps for the help.

tonyorr · 2017-01-04T08:01:49.000Z

No problem, Glad it works