使用 PowerShell 脚本获取 Windows 事件日志年龄

Jacki

2024-08-24

Windows 事件日志应至少在系统上保留 7 天，以便您可以查看它们以进行故障排除或任何其他目的。默认情况下，当达到最大事件日志大小时，事件日志将被覆盖。这意味着您将没有足够的日志历史记录，这可能会导致问题。在本文中，您将了解如何使用 PowerShell 脚本获取 Windows 事件日志年龄。

Get-EventLogAge.ps1 PowerShell 脚本将检查系统上的所有事件日志文件夹，并为您提供包含以下信息的报告：

日志名称
最旧事件日期
最新事件日期
自最古老事件以来的天数
最大MB
使用百分比

下载 Windows 事件日志时代 PowerShell 脚本

上创建两个文件夹（中：）驾驶：

脚本
温度

下载 Get-EventLogAge.ps1 PowerShell 脚本并将其放置在系统上C：脚本文件夹。如果您没有脚本文件夹，请创建一个。

确保该文件未被阻止，以防止运行脚本时出现任何错误。请阅读文章运行 PowerShell 脚本时出现未数字签名错误来了解更多信息。

另一种选择是将以下代码复制并粘贴到记事本中。给它起个名字获取EventLogAge.ps1并将其放置在 C:scripts 文件夹中。

<#
    .SYNOPSIS
    Get-EventLogAge.ps1

    .DESCRIPTION
    Export the oldest and newest event logs dates to a CSV file.

    .LINK
    www.alitajran.com/get-windows-event-log-age-powershell-script/

    .NOTES
    Written by: ALI TAJRAN
    Website:    www.alitajran.com
    LinkedIn:   linkedin.com/in/alitajran

    .CHANGELOG
    V1.00, 08/22/2024 - Initial version
#>

# CSV file path to export
$CsvPath = "C:tempEventLogAgeReport.csv"

# Get the current date
$currentDate = Get-Date

# Get all log names
$logNames = Get-WinEvent -ListLog * | Select-Object -ExpandProperty LogName

# Create a generic list to store report data
$Report = [System.Collections.Generic.List[Object]]::new()

# Iterate through each log and find the oldest and newest events
foreach ($logName in $logNames) {
    # Get the oldest event directly
    $oldestEvent = Get-WinEvent -LogName $logName -MaxEvents 1 -Oldest -ErrorAction SilentlyContinue |
    Select-Object -Property TimeCreated

    # Get the newest event directly
    $newestEvent = Get-WinEvent -LogName $logName -MaxEvents 1 -ErrorAction SilentlyContinue |
    Select-Object -Property TimeCreated

    # Get the log's maximum size and current size
    $logInfo = Get-WinEvent -ListLog $logName

    $maxSize = [math]::Round($logInfo.MaximumSizeInBytes / 1048576, 2)
    $currentSize = [math]::Round($logInfo.FileSize / 1048576, 2)

    if ($maxSize -ne 0) {
        $percentageUsed = [math]::Round(($currentSize / $maxSize) * 100, 2)
    }
    else {
        $percentageUsed = "N/A"
    }

    if ($oldestEvent) {
        # Calculate the number of days since the oldest event
        $daysAgo = ($currentDate - $oldestEvent.TimeCreated).Days

        $ReportLine = [PSCustomObject]@{
            LogName              = $logName
            OldestEventDate      = $oldestEvent.TimeCreated
            NewestEventDate      = $newestEvent.TimeCreated
            DaysSinceOldestEvent = "$daysAgo"
            MaxSizeMB            = "$maxSize MB"
            PercentageUsed       = "$percentageUsed %"
        }
        $Report.Add($ReportLine)
    }
    else {
        $ReportLine = [PSCustomObject]@{
            LogName              = $logName
            OldestEventDate      = "No events found"
            NewestEventDate      = "No events found"
            DaysSinceOldestEvent = "N/A"
            MaxSizeMB            = "$maxSize MB"
            PercentageUsed       = "$percentageUsed %"
        }
        $Report.Add($ReportLine)
    }
}

# Export the results to a CSV file
$Report | Export-Csv -Path $CsvPath -NoTypeInformation -Encoding Utf8

这就是它的样子。