forked from scriptrunner/ActionPacks
-
Notifications
You must be signed in to change notification settings - Fork 0
/
New-SysMEventLog.ps1
88 lines (73 loc) · 3.07 KB
/
New-SysMEventLog.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
#Requires -Version 5.0
<#
.SYNOPSIS
Creates a new event log and a new event source on the computer
.DESCRIPTION
When you create a new event log and a new event source, the system registers the new source for the new log, but the log is not created until the first entry is written to it
.NOTES
This PowerShell script was developed and optimized for ScriptRunner. The use of the scripts requires ScriptRunner.
The customer or user is authorized to copy the script from the repository and use them in ScriptRunner.
The terms of use for ScriptRunner do not apply to this script. In particular, ScriptRunner Software GmbH assumes no liability for the function,
the use and the consequences of the use of this freely available script.
PowerShell is a product of Microsoft Corporation. ScriptRunner is a product of ScriptRunner Software GmbH.
© ScriptRunner Software GmbH
.COMPONENT
.LINK
https://github.com/scriptrunner/ActionPacks/tree/master/WinSystemManagement/EventLogs
.Parameter LogName
[sr-en] Event log
.Parameter SourceName
[sr-en] Names of the event log sources, such as application programs that write to the event log
.Parameter ComputerName
[sr-en] Remote computer, the default is the local computer.
.Parameter CategoryResourceFile
[sr-en] Path of the file that contains category strings for the source events
.Parameter MessageResourceFile
[sr-en] Path of the file that contains message formatting strings for the source events
.Parameter ParameterResourceFile
[sr-en] Path of the file that contains strings used for parameter substitutions in event descriptions
#>
[CmdLetBinding()]
Param(
[Parameter(Mandatory = $true)]
[string]$LogName,
[Parameter(Mandatory = $true)]
[string]$SourceName,
[string]$ComputerName,
[string]$CategoryResourceFile,
[string]$MessageResourceFile,
[string]$ParameterResourceFile
)
try{
[string[]]$Properties = @('Log','LogDisplayName','MaximumKilobytes','OverflowAction','MinimumRetentionDays')
if([System.String]::IsNullOrWhiteSpace($ComputerName)){
$ComputerName = "."
}
[hashtable]$cmdArgs = @{'ErrorAction' = 'Stop'
'ComputerName' = $ComputerName
'Source' = $SourceName
'LogName' = $LogName
}
if(-not [System.String]::IsNullOrWhiteSpace($CategoryResourceFile)){
$cmdArgs.Add('CategoryResourceFile', $CategoryResourceFile)
}
if(-not [System.String]::IsNullOrWhiteSpace($MessageResourceFile)){
$cmdArgs.Add('MessageResourceFile', $MessageResourceFile)
}
if(-not [System.String]::IsNullOrWhiteSpace($ParameterResourceFile)){
$cmdArgs.Add('ParameterResourceFile', $ParameterResourceFile)
}
$null = New-EventLog @cmdArgs
$result = Get-EventLog -List -ComputerName $ComputerName | Where-Object -Property "Log" -eq $LogName | Select-Object $Properties
if($SRXEnv) {
$SRXEnv.ResultMessage = $result
}
else{
Write-Output $result
}
}
catch{
throw
}
finally{
}