So let's talk about creating scripts to collect log data.
If we wish to collect Windows Event Log entries,
then we can utilize what's called Get‑EventLog,
which is part of the MicrosoftPowerShell.Management schema.
This will retrieve the events in the event log,
a list of the event logs, both on local or remote computers.
This is the one that's been around for a long time,
it's referred to as the Legacy command.
If we wish to use the newer version, then this will be Get‑WinEvent,
which is part of the Microsoft.Powershell.Diagnostics.
This can get the events from the event logs and the
tracing logs on local and remote computers.
And then, of course, if we don't want to use PowerShell,
we can simply open up the Event Viewer and use the GUI interface to view them,
query them, export them, etc.
Now if I wanted to retrieve Event Log entries utilizing
PowerShell and I was using the Legacy option,
I could say Get‑EventLog.
I would tell it which event log, which in this case is going to be the system,
and you can see I'm filtering after a specific date and time,
and then I'm looking for errors and warnings.
If I was to do the same thing using the modern one,
so Get‑WinEvent, a little bit different,
what we do this time is we say Get‑WinEvent,
and then we create a hashtable, which filters out the values.
Now hashtables allow us to create key value pairs.
So, for example,
I've got a property called LogName with the two
different types of logs I wish to open, I've got Level,
and I've got StartTime.
Now the properties are not necessarily the same
between the two PowerShell cmdlets,
but it will allow you to retrieve the Windows Event Log entries.
Now, of course,
we can also then combine things altogether from
multiple servers if we wanted to, to do that remote connection.
So, for example, here you'll see that we've got a list coming from a file,
so I've got a Servers.txt, which has a list of just servers listed,
and then I'm going to say get the content of the file,
and then query that list utilizing a foreach command.
And then I'm going to call Get‑WinEvent and pass in the computer name,
which you'll recognize from the previous commands,
where if we wish to call something from a remote machine,
we'd simply use ‑ComputerName and pass in the value.