So let's go back into our environment and we'll look at
exporting log data from remote machines.
We'll connect to the Windows machine,
and then we'll export the log entries first,
and then we'll query them.
And then we'll also connect to a Linux machine and then export
the log entries and see if we can view them.
So we're back here on the Windows machine,
and what we're going to do is connect to the Windows Server 2022 server,
and we'll use the SSH option that we've got.
So I'm going to create a new variable called windows.
And then as we did in the past,
I'm just going to create a New‑PSSession to that IP
address that we had previously.
And obviously, remember,
our username for Windows needs to be uppercase or lowercase.
It's only if we use Linux do we need to make sure it's case‑sensitive.
And then I'm going to say SSHTransport, put the password in,
and then, of course, I now have a session.
So if I click Windows here, you can see it's an SSH connection to that machine.
Now,
I want to be able to use that session as part of
kind of executing various commands.
So one thing that we can do is obviously use the Invoke‑Command option,
which allows me to specify a kind of session that's available.
So I'm going to use my windows session.
And then, remember we can use the ScriptBlock.
So the ScriptBlock here allows me to send a command down an existing session,
and the ScriptBlock itself is the command I would like to run.
So the first thing I want to run here is Get‑WinEvent,
and I just want to get a list of all the logs that would be there.
So I'm going to press Enter here.
Now, of course, the screen is going to go crazy, so I'm going to stop that.
But this is now giving me a full list of all of the event
logs that exist on that remote machine.
So you can see, I've got my audit log here for SMB Server connectivity log,
etc., etc.
Now if we just go and change this and just say format table,
you'll get a longer table, but it's easier to kind of view.
But you can see all of the event logs.
Now often,
you forget that there are event logs for all kinds of
different pieces within Windows, not just the three common ones,
which would be security, system, and application.
Now what about if we wanted to get rid of‑‑‑ Now what about if
we wanted to just get specific logs where there were actually
events because you can see in here, this one says 44,
all of these say 0, that one says 15, all of these say 0,
that one says 101, and that's the number of items that are there.
So let's clear the screen here, and we're going to use our same Get‑WinEvent,
but this time I'm not going to say ListLog with the
parameter for listing them as a table.
I'm going to add in an extra piece of command, so I'm going to say Where‑Object.
And there's a property that we want to use called RecordCount,
and I'll just say is greater than 0 and execute that.
Now, of course, it now puts it in that 4D format,
so let's go back and stop that and say format table.
And now you'll see that all of those 0 options have now gone.
So now I can see the specific logs that have entries in that I want
to interrogate or investigate like this one here,
for example,
Windows‑SystemDataArchiver/Diagnostic has a significant amount of log entries,
so that might be one for us to look at.
Now, what about if we already know the log file that we want to get to?
So let me go back to my command here.
Let me get rid of all of this here.
And we'll simply just use Get‑WinEvent.
And this time, we'll say LogName Security,
which is really one of the most important ones.
So I'm going to press Enter here, and I'm just going to pause it again.
It's going to give me a list of all of the entries that reside
in the security log on the remote machine.
Now, what's great about that is obviously it lists me everything.
But often, I don't need to see all of the event logs,
so I can use what's called MaxEvents 5, and then to change the view a little bit,
what I'm going to do here is say Select‑Object Property and star.
So what that will do is instead of seeing the
individual rows with three or four columns,
it will turn it the other way around and show me all of the
columns for each of those five events.
So if I just press Enter here, there we go.
So you can see,
if I just scroll a little bit further up so we can see all of one,
let's get to the top here, you can see that we've got entries in here,
and you've got run space IDs, messages, record IDs,
basically every single property.
So it's the same as when you go into the event viewer and
you double‑click one of the events,
and then you get to expand the information that's displayed in that
screen, or you go to the XML tab and see the information.
So we can start to really go to town,
looking at the information that's stored inside the event logs.
Now what about if we already know the item that we're looking for?
So let's go back and change our query again.
So we're going to stick with our Security one.
And what we'll do is we can go back to our Where‑Object.
So our Where‑Object allows us to filter.
I'm going to say Property,
and the property that I know has specific numbers would be Id.
Then I can say equals, and then let's say I want to use 4624 as a standard one.
I can press Enter.
And sure enough, you can see that this one comes back,
and there's loads of them here.
It says an account was successfully blah blah.
But what does that mean because I can't really see any of the values?
So let me clear this again.
And if we go back to here, I can then say format table, and we get a table.
It says oh, automatically logged on, and that's the value that we're looking for.
Now if we have larger messages, we can obviously see that they get truncated.
So we could change the way that we did this.
So we could say let's not do that.
Let's do another Select‑Object, and we'll say Property and star.
And then, of course,
you get all the breakdown kind of structured back the other way around,
but for that specific identifier that we chose.
And it basically says the account was logged on, and there's all the details.
So, it's an easy way of being able to retrieve information from another machine.
Now obviously, we were just using standard Select‑Objects,
Where‑Objects,
but the most common way of doing it is to use what's called FilterHashtable.
So I'm going to go ahead and just remove some of this information
here back to our standard Get‑WinEvent LogName.
So, what we're going to do is change this a little bit.
We're not going to choose the LogName using that parameter.
We're going to use what's called FilterHashtable.
Now the FilterHashtable is a key value pair.
So I can say these are my options here.
And one of the first properties that's available to me is LogName,
and I'm going to say Security like so.
And then I can add that 4624 again as another ID.
So the idea behind this is that we can combine all the properties together.
Now you may have been using PowerShell for a while and we have
the idea of when you're creating variables,
you might be populating things into an array.
A FilterHashtable is effectively a larger array of values.
So I'm going to press Enter here. And sure enough, it goes
ahead and gets me the same sets of values.
So a FilterHashtable really allows me to pass further
information to get out of the logs as needed.
Now, of course,
we can use other items, such as the XPath and the getting information
from the XML structure. All of them work the same way. They are there to
help us retrieve values from a specific log.
Now, of course, I've been using just the security log.
So I'm going to go back here and just say LogName. Let's say
application, and I can press Enter. And then, of course, I get
application‑level ones as well.
So this works for every single log.
It also works for all of those other logs that we wouldn't normally look at.
Or it can also work for any of the exported logs that we may have
brought out because, of course, we do have the capability to export log
files to a VTX format and then reattach them,
which we'll touch on a little bit later.
But that's how we connect to a remote Windows machine and
get log entries directly from them.