Function for getting events

PowerShell Help
1

Hi Guys,

Looking for some help or ideas on how to create a function that will allow to get event log information. See below on the requirements

This is to be used for my HTML Powershell report as I’m wanting to convertto-HTML the following

ComputerName variable, Logname (normally application, system or security), Type and from the last hour, 24 hours and week.

 param([string]$ComputerName
    , [HashTable]$data
    , [string]$LogName
    , [string]$EntryInfo = "Information"
    , [string]$EntryWarn = "Warning"
    , [string]$EntrError = "Error"
    , [int]$LastHour = (Get-Date).AddHours(-1)
    , [int]$LastDay  = (Get-Date).AddHours(-24)
    , [int]$LastWeek = (Get-Date).AddDays(-7))

        try
        {

        $data = @()
        $Events = Get-EventLog -ComputerName $computername -LogName $LogName -EntryType $EntryError,$EntryWarn,$EntryInfo -After (Get-Date).AddHours(-1) -ErrorAction STOP -Verbose

        foreach ($event in $Events) {
		    $row = [PSCustomObject]@{
			    'Date/Time'      = $event.TimeWritten
                'EventID'        = $event.EventID
			    'Message'        = $event.Message
                'Source'         = $event.Source
                'Entry Type'     = $event.EntryType
		}
            $data += $row

?

2

Not to discourage, but based on the number of hosts and the overall requirement, you might want to consider sending those to Azure Log Analytics and using that to analyze (and draw reporting doughnuts as needed) and alert.

3

The function wrapper is not really accomplishing anything and it actually getting the results slower by looping through the results. Get-EventLog is already function. Just provide the logname and computername:

try {
    $params = @{
        ComputerName = $computername 
        LogName      = $LogName 
        EntryType    = 'Information','Warning','Error'
        After        = (Get-Date).AddHours(-1) 
        ErrorAction  = 'Stop'
    }

    $Events = Get-EventLog @params |
            Select-Object -Property TimeWritten,EventId,Message,Source,EntryType,@{Name='ComputerName';Expression={$ComputerName}}
}
catch {
    [PSCustomObject]@{
        TimeWritten  = $null
        EventId      = $null
        Message      = ('Failed to get events. {0}' -f $_)
        Source       = $null
        EntryType    = $null
        ComputerName = $ComputerName
    }
}
4

Thanks for the suggestions…the last recommendation seems neat and will work…