로그인
 
홈라이브러리학습다운로드지원커뮤니티포럼
Resources for IT Professionals >
> 
> 
event log failed logins

답변됨 event log failed logins

  • 2012년 3월 9일 금요일 오전 9:29
     
      코드 있음
    로그인하여 투표
    0

    Hi,

    I wrote my first powershel script today to extract failed logins for a particular database on one of our servers.

    $startdate = (Get-Date).AddDays(-31)
$enddate = (Get-Date -f yyyy-MM-dd)
$out_file = "\\sharepoint\DavWWWRoot\IT\\Access Login Failures\Failed_Logins_" + $enddate + ".csv" 
Get-EventLog Application -Computer DB01 -After $startdate  |where{$_.Message -like "*Password*" -and $_.Message -notlike "*A'. *" }|where{$_.EventId -eq "18456"}|select username,message,timegenerated | export-csv $out_file -force 

    It works well and extracts the two fields I need. Although I want to improve it by making it select only the username from the Eventlog 'message'  column. The username is surrounded by two apostrophies e.g. 'USERNAME'.  

    Is this possible?



    • 편집됨 nick9one1 2012년 3월 9일 금요일 오전 9:37
    •  
     

모든 응답

  • 2012년 3월 9일 금요일 오전 10:13
     
     답변됨 코드 있음
    로그인하여 투표
    0

    Hi,

    Not tested but should works: @{l="username";e={$_.message -match "'.+'" | out-null; $matches[0]}}

    Get-EventLog Application -Computer DB01 -After $startdate | where{$_.Message -like "*Password*" -and $_.Message -notlike "*A'. *" -and $_.EventId -eq "18456"} | select @{l="username";e={$_.message -match "'.+'" | out-null; $matches[0]}},message,timegenerated | export-csv $out_file -force