Export Multiple Remote Server Event Logs

talonzahntalonzahn · 2019-09-26T13:48:57.000Z

Not sure what’s going wrong here. It seems to be running, but I keep getting Error Connecting to : No Events were found that match the specified selection criteria.

$Computername = get-content "C:\Lindsay\Computers.txt"
$StartTime = (get-date)
$EndTime = (get-date).AddDays(-30)

<# Event Log Levels
    1 = Critical
    2 = Error
    3 = Warning
    4 = Information
    5 = Verbose 
    #> 
$Levels = @('Placeholder-0','Critical','Error', 'Warning', 'Information', 'Verbose')

$EventFilter = @{Logname='System','Application'
                Level=1,2,3,4
                StartTime=$StartTime
                EndTime=$EndTime
                }     

foreach($Computer in $Computername) {
    try {

        $Events = Get-WinEvent -ComputerName $Computer -Verbose:$false -ErrorAction Stop -FilterHashtable $EventFilter 

        $Output = $Events | Select-Object @{n='Computer';e={$Computer}}, TimeCreated,LogName, @{n='Level';e={$Levels[$($_.Level)]}}, Message 

        #Output to Screen
        $Output | ft

        #Export to File 
        #Output | Out-File C:\Lindsay\WinEvents-$Computer.txt

    } catch {

        Write-warning "Error connecting to server: $Computer - $($Error[0])"
    }
}

Neally · 2019-09-26T14:11:48.000Z

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don't say "Need help" or "PowerShell Help", actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy, past…

Neally · 2019-09-26T14:12:43.000Z

talonzahntalonzahn:

I keep getting Error Connecting to : No Events were found that match the specified selection criteria

does it work when you run it against your own computer?

jitensh · 2019-09-26T14:32:41.000Z

That means no events found

catch $_{
        if ($_ -match "No events were found that match the specified selection criteria") {
        Write-Host "No events found on $($computer)"

Does that happen to all computers?

talonzahntalonzahn · 2019-09-26T14:33:14.000Z

Same error.

I am a Domain Admin and Local Admin as well.

I was thinking it was a remote execution setting blocking it, until now.

talonzahntalonzahn · 2019-09-26T14:47:11.000Z

Maybe, but it’s set to pick all 4 levels, and I can see the “Information” level items just going into the Event Viewer.
Which is why I was focusing more on the :Error Connecting" part.

Evan7191 · 2019-09-26T14:48:33.000Z

It looks like your start and end times are reversed.

$StartTime = (get-date)
$EndTime = (get-date).AddDays(-30)

Usually the start time is the earlier date, and the end time is the later date.

talonzahntalonzahn · 2019-09-26T14:58:01.000Z

Good catch on the Date, same error though.

Evan7191 · 2019-09-26T15:30:32.000Z

I fixed the date issue in the script, and it ran successfully on some remote test machines in my environment. The problem seems to be with connectivity rather than with logic in your code.

Have you run Test-Connection and/or Test-NetConnection to check connectivity to the remove computers?

Evan7191 · 2019-09-26T15:33:13.000Z

Get-WinEvent uses RPC for remoting. Does a firewall block RPC between the local and remote computers?

talonzahntalonzahn · 2019-09-26T15:38:58.000Z

Yea, if I get on a DC, it runs like a champ and now I’ll just change it to Export instead of Output and roll on.

So it appears the Date fix was the ACTUAL fix.

Again, very good catch, and thanks for the extra test on your side!