Now it's all good and well being able to connect to a Windows machine,
which obviously is intrinsically connected together by the very nature that
we're using Windows 10 and Windows 2022 or whatever it might be.
But what about if we want to include Linux into the equation?
So what we'll do here is we'll create a new variable called linux,
and then we'll do the New‑PSSession that we did before.
Obviously, our IP address is going to be different this time,
so let me just put that in here.
And then remember, the key here, make sure that your username is case‑sensitive.
Otherwise, it won't actually work.
We'll then try and connect, put the password in,
and then we should get a returned connection for that specific account.
So let me just double‑check that.
We'll type linux.
And sure enough, we now have a remote connection.
If you ever want to see any of the remote sessions,
we can say Get‑PSSession,
and you can see I've still got the previous one open as well.
Now,
the downside obviously that we talked about earlier using
Linux is that the log files obviously don't necessarily
function the same way as Windows.
So when it comes to using an event log, we don't necessarily have an event log.
We have log files that are physical files.
So what we can do is we can use the same option we had before,
which is Invoke‑Command.
Or what I can do is I can say Enter‑PSSession.
And then, of course, you see I can loop through the various options,
and I can say linux, and then I can press Enter,
and it drops me into an interactive session inside the
PowerShell for that specific machine.
So obviously, it takes a bunch of space here.
So you can see I've got trainer at whatever and then the root directory.
Now once I'm in here, I can utilize standard PowerShell commands,
like Get‑ChildItem, for example.
But I can't use things like if I go back here and say WinEvent and try to tab,
I don't get anything back, and that's because it doesn't exist in this context.
So when we try to access the log files in Linux,
we have to access them in a little different way by
basically reading the document or the log and then opening
up the values that are in there.
So I'm going to say go and get me the child items that exist in var/log.
Now, of course, you'll see here, we've got things like the kernel log,
the system log, advantage timer log.
We've got the VMware network log, etc.
So there's a whole host of log files that exist.
Now what about if we wanted to actually look inside those logs?
Because, of course,
it's not like the Event Viewer where you can connect to
the service and say get me all of these.
We now need to somehow open those up.
So what about if we wanted to open just a specific log?
So let's go this time and say Get‑Content.
So instead of using Get‑ChildItem,
which is going to list me all of the files inside a directory,
I'm going to say Get‑Content var and then log directory.
And then what I'll do is I can say auth.log.
And then this just throws out on the screen all of the items,
very much like when you retrieve the Event Viewer items.
So that's great, but what do we do with it?
It's just a bunch of log files.
And can we query items that are in there?
Well, of course, we can.
So, what we're going to do is I'm going to clear the screen,
and then we're going to use Get‑ChildItem again to go into each log file.
And then I want to get the first item out of each of them.
So that will at least give us a way of having a quick scan in
all of the log files for the very first items.
So now the screen is clean.
What we can then do is type in a query of being
able to get the individual items.
So like we did before, we're going to use Get‑ChildItem like so.
You can see we're using the var/log,
and then I'm going to say file because I want to retrieve the individual files.
Then I'm going to say well let's loop each of those files, so ForEach‑Object.
And of course, we're using standard PowerShell.
Now I find this interesting and fun that we're writing full‑on
PowerShell directly into a Linux machine.
So when we loop the object, we obviously get this variable, which is the $_.
I'm then going to say for each one that we've got,
we're going to go and use Get‑Content this time, and then I'm
going to say Select. We'll use Select‑Object.
I was going to use Select‑String, but we'll use Object. And get me the first
one and then skip five of them like so. So let's press Enter.
Now, of course, it looks very strange, but what you'll see is you get
this combination of log entries being dropped out so you can see I've
got something to do with package kits, I've got some to do with access is denied,
something to do with access to a path, status.
It doesn't really kind of help.
So there must be a better way I've been able to get values out.
And perfectly there is. So I'm going to create a new variable here.
I'm going to call it path. I'm going to set the path to the specific
location that I want to output the file to.
So this one here is I want to create something, and I'm going to output it as
a CSV into my root directory on that machine. I'm going to create another
variable called results, and we're going to use that Get‑Content option again
where I can say var/log/auth.log. And then we're going to use a different
option called Select‑String, and I want to identify anything that has trainer
written in that log file.
It could be single log files or multiple. For this instance, we're
just going to use the auth.log itself, so I'm going to press Enter.
And then if I do results, you'll see it gives me a whole host of
different things, so failed passwords, logins,
etc. So let me clear that one again. For our last step, what I want to do is
then take the results, and I'm going to use Export‑Csv. Let me do Path path,
and then I'm just going to say NoTypeInformation. Otherwise, it puts that top
row with a bunch of information there.
So I'm going to say export. Now what did that do?
Well, it exported a file. So I can say list directory, and you'll see there's
an auth.csv that is there. At that point, I can then take that auth.csv,
which is in a better format than maybe the files that exist in Linux and
actually open it and see what's in there.
So, let's have a quick peek. We'll hop into the Ubuntu Linux machine,
and we'll open that CSV file. So here's the Ubuntu Linux machine, and
you can see I've got my auth.csv. So I'm going to right‑click here and
just say Open with LibreOffice Calc,
which is just the application that's on here. And you'll see there's a
bunch of information, so I'm going to click Okay,
just let it open, and click OK.
And you'll see that all of that information that we were looking at,
I'm just going to zoom in a fraction here, is now listed as individual rows.
Now I may have to parse some of those values out,
but it means I have them in a spreadsheet‑type format where I'm able to go
through and access the information and use them as needed.
So there are times where you may want to export the information
out into CSVs or other formats to help in being able to look for
anomalous activities or look for specific types of events on
both Linux and on Windows.