Asked by:
Event based 'Event Log monitoring' PowerShell script

Question
-
I'm struggling to create an event based PowerShell script to continiously monitor certain events that are happening on a computer.
First of all, I tried to base my script on a snippet I found online (see the code under this text).
I noticed the use of '[System.Diagnostics.EventLog]' which is OK if you use 'old' logs like 'System', 'Application'..,
but this doesn't work for 'new' log files like 'Microsoft-Windows-Wired-AutoConfig/Operational' where I'm looking for ID's 15500 and 15501
(Using 'Get-EventLog' doesn't show this log, but 'Get-WinEvent' does)So I've been trying different things but I can't figure out how to get this working for the 'new' logfiles.
Anyone has any idea?
# set the event log name you want to subscribe to
# (use Get-EventLog -AsString for a list of available event log names)
$Name = 'Application'
# get an instance
$Log = [System.Diagnostics.EventLog]$Name
# determine what to do when an event occurs
$Action = {
# get the original event entry that triggered the event
$entry = $event.SourceEventArgs.Entry
# do something based on the event
if ($entry.EventId -eq 1 -and $entry.Source -eq 'WinLogon')
{
Write-Host "Test event was received!"
}
}
# subscribe to its "EntryWritten" event
$job = Register-ObjectEvent -InputObject $log -EventName EntryWritten -SourceIdentifier 'NewEventHandler' -Action $Action
# use a loop to keep PowerShell busy. You can abort via CTRL+C
Write-Host "Listening to events" -NoNewline
try
{
do
{
Wait-Event -SourceIdentifier NewEventHandler -Timeout 1
Write-Host "." -NoNewline
} while ($true)
}
finally
{
# this executes when CTRL+C is pressed
Unregister-Event -SourceIdentifier NewEventHandler
Remove-Job -Name NewEventHandler
Write-Host ""
Write-Host "Event handler stopped."
}Tuesday, July 9, 2019 8:35 AM
All replies
-
$log = [System.Diagnostics.EventLog]::New('Microsoft-Windows-Wired-AutoConfig/Operational')
\_(ツ)_/
Tuesday, July 9, 2019 9:05 AM -
Great find jrv! After adding this in the code and GMing the object, it does appear to have a membertype 'event' with name 'entrywritten'
But still stuck on the error that the event log doesn't exist. (again: works fine for 'old' logs, like System log)
Register-ObjectEvent : The event log 'Microsoft-Windows-Wired-AutoConfig/Operational' on computer '.' does not exist.
At line:96 char:8
+ $job = Register-ObjectEvent -InputObject $WIREDautoconfig -EventName ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Diagnostics.EventLog:EventLog) [Register-ObjectEvent], InvalidOperationException
+ FullyQualifiedErrorId : INVALID_REGISTRATION,Microsoft.PowerShell.Commands.RegisterObjectEventCommandTuesday, July 9, 2019 11:28 AM -
That log will not exist on all systems. If it doesn't exist then you can't use it.
\_(ツ)_/
Tuesday, July 9, 2019 11:31 AM -
Check that the log exists:
Get-WinEvent -ListLog Microsoft-Windows-Wired-AutoConfig/Operational\_(ツ)_/
Tuesday, July 9, 2019 11:36 AM -
PS C:\WINDOWS\system32> Get-WinEvent -ListLog Microsoft-Windows-Wired-AutoConfig/Operational
LogMode MaximumSizeInBytes RecordCount LogName
------- ------------------ ----------- -------
Circular 1052672 1166 Microsoft-Windows-Wired-AutoConfig/OperationalTuesday, July 9, 2019 11:41 AM -
It appears that these logs cannot be evented. It may be that the logs need to have the subscription service configured and enabled.
\_(ツ)_/
Tuesday, July 9, 2019 12:03 PM -
I believe there must be a way to query these logs, since you can create a 'task' in the Task Scheduler that executes an action if it finds a certain ID.
But what that 'way' is.. that's something else..
Monday, July 15, 2019 11:28 AM -
Try using System.Diagnostics.Eventing.Reader.EventLogWatcher
https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogwatcher?view=netframework-4.8
Monday, July 15, 2019 1:22 PM -
Here s a working example of the "Watcher". '
$code = @' Imports System Imports System.Diagnostics.Eventing.Reader Public Class SubscribeToEventsExample Public Sub New() Dim watcher As EventLogWatcher watcher = Nothing Try ' Subscribe to receive event notifications ' in the Application log. The query specifies ' that only level 2 events will be returned. Dim subscriptionQuery As New EventLogQuery("Application", PathType.LogName, "*[System/Level>0]") watcher = New EventLogWatcher(subscriptionQuery) ' Set watcher to listen for the EventRecordWritten ' event. When this event happens, the callback method ' (EventLogEventRead) will be called. AddHandler watcher.EventRecordWritten, AddressOf Me.HandleEvent ' Begin subscribing to events the events watcher.Enabled = True Console.WriteLine("Waiting for events...") Dim i As Integer For i = 0 To 10000 ' Wait for events to occur. System.Threading.Thread.Sleep(1000) Next Catch e As EventLogReadingException Console.WriteLine("Error reading the log: {0}", e.Message) Finally ' Stop listening to events watcher.Enabled = False If Not watcher Is Nothing Then watcher.Dispose() End If End Try End Sub ' <summary> ' Callback method that gets executed when an event is ' reported to the subscription. ' </summary> Public Sub HandleEvent(ByVal obj As Object, ByVal arg As EventRecordWrittenEventArgs) Console.WriteLine("Received event from the subscription.") ' Make sure there was no error reading the event. If Not arg.EventRecord Is Nothing Then Console.WriteLine("Received event {0} from the subscription.", _ arg.EventRecord.Id) Console.WriteLine("Description: {0}", arg.EventRecord.FormatDescription()) Else Console.WriteLine("The event instance was null.") End If End Sub Public Overloads Shared Function Main( _ ByVal args() As String) As Integer ' Start the event watcher Dim eventWatcher As New SubscribeToEventsExample Return 0 End Function End Class '@ add-type $code -Language VisualBasic [SubscribeToEventsExample]::new()
\_(ツ)_/
- Edited by jrv Monday, July 15, 2019 2:04 PM
Monday, July 15, 2019 2:03 PM