使用 PowerShell 腳本獲取 Windows 事件日誌年齡

Jacki

2024-08-24

Windows 事件日誌應至少在系統上保留 7 天，以便您可以查看它們以進行故障排除或任何其他目的。默認情況下，當達到最大事件日誌大小時，事件日誌將被覆蓋。這意味著您將沒有足夠的日誌歷史記錄，這可能會導致問題。在本文中，您將了解如何使用 PowerShell 腳本獲取 Windows 事件日誌年齡。

Get-EventLogAge.ps1 PowerShell 腳本將檢查系統上的所有事件日誌文件夾，並為您提供包含以下信息的報告：

日誌名稱
最舊事件日期
最新事件日期
自最古老事件以來的天數
最大MB
使用百分比

下載 Windows 事件日誌時代 PowerShell 腳本

上創建兩個文件夾（中：）駕駛：

腳本
溫度

下載 Get-EventLogAge.ps1 PowerShell 腳本並將其放置在系統上C：腳本文件夾。如果您沒有腳本文件夾，請創建一個。

確保該文件未被阻止，以防止運行腳本時出現任何錯誤。請閱讀文章運行 PowerShell 腳本時出現未數字簽名錯誤來了解更多信息。

另一種選擇是將以下代碼複製並粘貼到記事本中。給它起個名字獲取EventLogAge.ps1並將其放置在 C:scripts 文件夾中。

<#
    .SYNOPSIS
    Get-EventLogAge.ps1

    .DESCRIPTION
    Export the oldest and newest event logs dates to a CSV file.

    .LINK
    www.alitajran.com/get-windows-event-log-age-powershell-script/

    .NOTES
    Written by: ALI TAJRAN
    Website:    www.alitajran.com
    LinkedIn:   linkedin.com/in/alitajran

    .CHANGELOG
    V1.00, 08/22/2024 - Initial version
#>

# CSV file path to export
$CsvPath = "C:tempEventLogAgeReport.csv"

# Get the current date
$currentDate = Get-Date

# Get all log names
$logNames = Get-WinEvent -ListLog * | Select-Object -ExpandProperty LogName

# Create a generic list to store report data
$Report = [System.Collections.Generic.List[Object]]::new()

# Iterate through each log and find the oldest and newest events
foreach ($logName in $logNames) {
    # Get the oldest event directly
    $oldestEvent = Get-WinEvent -LogName $logName -MaxEvents 1 -Oldest -ErrorAction SilentlyContinue |
    Select-Object -Property TimeCreated

    # Get the newest event directly
    $newestEvent = Get-WinEvent -LogName $logName -MaxEvents 1 -ErrorAction SilentlyContinue |
    Select-Object -Property TimeCreated

    # Get the log's maximum size and current size
    $logInfo = Get-WinEvent -ListLog $logName

    $maxSize = [math]::Round($logInfo.MaximumSizeInBytes / 1048576, 2)
    $currentSize = [math]::Round($logInfo.FileSize / 1048576, 2)

    if ($maxSize -ne 0) {
        $percentageUsed = [math]::Round(($currentSize / $maxSize) * 100, 2)
    }
    else {
        $percentageUsed = "N/A"
    }

    if ($oldestEvent) {
        # Calculate the number of days since the oldest event
        $daysAgo = ($currentDate - $oldestEvent.TimeCreated).Days

        $ReportLine = [PSCustomObject]@{
            LogName              = $logName
            OldestEventDate      = $oldestEvent.TimeCreated
            NewestEventDate      = $newestEvent.TimeCreated
            DaysSinceOldestEvent = "$daysAgo"
            MaxSizeMB            = "$maxSize MB"
            PercentageUsed       = "$percentageUsed %"
        }
        $Report.Add($ReportLine)
    }
    else {
        $ReportLine = [PSCustomObject]@{
            LogName              = $logName
            OldestEventDate      = "No events found"
            NewestEventDate      = "No events found"
            DaysSinceOldestEvent = "N/A"
            MaxSizeMB            = "$maxSize MB"
            PercentageUsed       = "$percentageUsed %"
        }
        $Report.Add($ReportLine)
    }
}

# Export the results to a CSV file
$Report | Export-Csv -Path $CsvPath -NoTypeInformation -Encoding Utf8

這就是它的樣子。