Get-EventLog with Append

682 Views Asked by At

So i have this code below that collects the stated EventIDs with the use of append. The problem is have is it only saves to a single file. What i want to do is save the collection to a daily file so i can do a daily report. A little help please?

$endtime = Get-Date
$starttime = (Get-Date).AddHours(-3)
$domain = "ComputerName"

$event = get-eventlog security -ComputerName $domain -after $starttime -before $endtime | where-object {($_.EventID -eq  4724) -or ($_.EventID -eq 4723) -or ($_.EventID -eq 4720)}
$event | select MachineName,EventID,TimeGenerated,Message | export-csv -path "E:\EventLogs\temp.csv"
get-content "E:\EventLogs\temp.csv" | out-File -filepath "E:\EventLogs\AccountAudit.csv" -append -enc ASCII -width 500
2

There are 2 best solutions below

2
Sonny Puijk On

Simply add a get-start with some parameters to get a date that's filename friendly (no "/" for example) and save it in a variable. Then replace AccountAudit on the last line with the variable.

0
Avshalom On

Export-Csv Has an -Append Parameter as well, you can shorten your code to:

$event = get-eventlog security -ComputerName $domain -after $starttime -before $endtime | 
Where-object {($_.EventID -eq  4724) -or ($_.EventID -eq 4723) -or ($_.EventID -eq 4720)}

$event | select MachineName,EventID,TimeGenerated,Message | 
Export-Csv -path "E:\EventLogs\AccountAudit.csv" -Append -Encoding ASCII