So now that we've got the remote connections,
the main objective here was to allow us to connect to
these devices and then export information.
So we're going to talk about exporting log data from remote machines.
Now exporting event logs is done using two PowerShell cmdlets.
The first one is called Get‑EventLog.
This one's actually a deprecated command,
and it's not recommended by Microsoft, but it is still available.
The newer one is Get‑WinEvent.
This is the latest command.
It's Microsoft‑recommended,
and it supports the modern Windows event log capabilities.
So we're going to focus on Get‑WinEvent.
The Get‑WinEvent command supports modern event logs
and the backwards classic logs.
It returns event information, sorted newest to oldest automatically.
You can retrieve event trees from selected logs.
You can retrieve events from selected log providers as well.
You can also filter using XPath, XML, and what's called hash table queries.
And it's only available on the Windows platform.
There is nothing similar that exists in the standard
PowerShell for you working with Linux.
So if I want to retrieve Windows event logs,
I can simply say Get‑WinEvent ‑ListLog with a star,
and this will list all of the event logs.
Now, of course, we all know the standard ones,
which is application system security.
But many of the applications that are installed or the services have their own.
We can retrieve specific log entries by going to the list of logs.
So for example, I'm saying go and get me all of the logs,
and then get it where the record count is greater than 0.
So maybe there's 100 event logs.
I only want to get the ones that have entries.
If I want to retrieve specific entries from,
for example, the security log, then I simply pass LogName,
and then you can see I'm filtering here get me a maximum of
five events and get me all of the properties.
Now if I want to filter Windows event log entries,
now we get to add various properties.
So you can see, I'm going to use Get‑WinEvent LogName Security,
which just means I'm using my security log,
and I can use Where‑Object, and then I can pass properties.
So I'm simply saying get me where the event log ID is 4624.
I could also use what's called a hash table.
A hash table is a different property.
It's called FilterHashtable.
It's effectively a set of key value pairs.
In this instance, you say LogName equals and then ID equals,
and I get the same thing.
I can also use variables in a hash table as well.
So I can say my LogName is security, my startdate is something,
my endDate is something,
and then I can say Get‑WinEvent and put all of those values in.
Now you'll see my startDate and endDate empty because they could
be any specific date that we wanted to utilize.
Now if we're trying to get Linux logs, it's a bit more complicated.
We need to know where the Linux logs are.
Luckily, our authorization log,
so mostly for Ubuntu Linux or some of the standard ones,
is stored in var/log/auth.log, and this one will keep track of authorization,
password prompts, sudo commands, etc.
Then we have the daemon log.
Daemons are the programs that run in the background,
kind of like the services or the processes on Windows.
Then we have the debug log, which will give you information,
so from Ubuntu, such as the system and applications.
We then get the kernel log, and then, of course,
we have the system log,
which effectively is the same as the event log that
you would get within Windows.
So how do we get the log entries from Linux?
Well, first off, we need to use a different type of command.
So if I have PowerShell running on Linux,
I can say Get‑ChildItem and then go var/log,
and that will list me all of the logs that are available in the log location.
If I wanted to retrieve information from those,
I could do Get‑ChildItem, go to the log file,
and then loop through each of that.
But because it's a flat file, it's a .log file,
I actually have to open that by using what's called Get‑Content,
and then you can see I'm selecting the very first one.
I could also simply just open the log file by using Get‑Content and pass it,
and it will render that out to the screen.
Now that's great,
but the problem is I want something that I can use in PowerShell.
So what about exporting the log entries into something that we can utilize?
So you can see here I've got my path, which is my trainer/auth.csv,
which is the file I want to export.
You can see I'm then using Get‑Content and going to the auth.log,
and then I'm selecting a string.
So Select‑String allows me to query inside the log file for trainer,
which is my account.
And then I'm going to pass those results to the Export‑Csv function
where it's going to output that CSV file for me,
which means I can then import back into PowerShell and start to interrogate.
So you'll find that when using Linux,
you may need to export the log files into other
formats to be able to utilize them.