Hello all,
I’m writing a function to retrieve from a series of events (eventID 153) binary data in XML view.
My issue is with the output, which seems to be stored in hashtable.
Function Get-StorPortXMLEvents { #Local path to evtx file. $GenEvtPath = 'C:\tmp\diskErrors.evtx' #Setting to xml $EventData = ([xml[]](Get-WinEvent -FilterHashtable @{Path = $GenEvtPath} -MaxEvents 5).toxml()) #Enumerating objects with foreach foreach ($diskEvt in $EventData) { #Which info I want to pull $EvtProperties = @{ Data = $EventData.event.eventdata.data Binary = $EventData.event.eventdata.binary TimeCreated = $EventData.event.system.timecreated.systemtime } #Creating my object $MyObj = New-Object -TypeName psobject -Property $EvtProperties Write-Output $MyObj } }
The output:
[13:19 PM C:\]> Get-StorPortXMLEvents | fl TimeCreated : {2017-11-02T13:30:54.386394300Z, 2017-11-02T13:30:51.872859400Z, 2017-11-02T13:30:51.575979800Z, 2017-10-27T05:49:39.077479800Z...} Data : {\Device\Harddisk3\DR3, 0x890f1a8, 3, \Device\MPIODisk0...} Binary : {0F01040004002C00000000009900048000000000000000000000000000000000000000000000000000000928, 0F01040004002C0000000000990004800000000000000000000000000000000000000000000000000000092A, 0F01040004002C00000000009900048000000000000000000000000000000000000000000000000000000988, 0F01040004002C00000000009900048000000000000000000000000000000000000000000000000000000928...} TimeCreated : {2017-11-02T13:30:54.386394300Z, 2017-11-02T13:30:51.872859400Z, 2017-11-02T13:30:51.575979800Z, 2017-10-27T05:49:39.077479800Z...} Data : {\Device\Harddisk3\DR3, 0x890f1a8, 3, \Device\MPIODisk0...} Binary : {0F01040004002C00000000009900048000000000000000000000000000000000000000000000000000000928, 0F01040004002C0000000000990004800000000000000000000000000000000000000000000000000000092A, 0F01040004002C00000000009900048000000000000000000000000000000000000000000000000000000988, 0F01040004002C00000000009900048000000000000000000000000000000000000000000000000000000928...} TimeCreated : {2017-11-02T13:30:54.386394300Z, 2017-11-02T13:30:51.872859400Z, 2017-11-02T13:30:51.575979800Z, 2017-10-27T05:49:39.077479800Z...} Data : {\Device\Harddisk3\DR3, 0x890f1a8, 3, \Device\MPIODisk0...} Binary : {0F01040004002C00000000009900048000000000000000000000000000000000000000000000000000000928, 0F01040004002C0000000000990004800000000000000000000000000000000000000000000000000000092A, 0F01040004002C00000000009900048000000000000000000000000000000000000000000000000000000988, 0F01040004002C00000000009900048000000000000000000000000000000000000000000000000000000928...} TimeCreated : {2017-11-02T13:30:54.386394300Z, 2017-11-02T13:30:51.872859400Z, 2017-11-02T13:30:51.575979800Z, 2017-10-27T05:49:39.077479800Z...} Data : {\Device\Harddisk3\DR3, 0x890f1a8, 3, \Device\MPIODisk0...} Binary : {0F01040004002C00000000009900048000000000000000000000000000000000000000000000000000000928, 0F01040004002C0000000000990004800000000000000000000000000000000000000000000000000000092A, 0F01040004002C00000000009900048000000000000000000000000000000000000000000000000000000988, 0F01040004002C00000000009900048000000000000000000000000000000000000000000000000000000928...} TimeCreated : {2017-11-02T13:30:54.386394300Z, 2017-11-02T13:30:51.872859400Z, 2017-11-02T13:30:51.575979800Z, 2017-10-27T05:49:39.077479800Z...} Data : {\Device\Harddisk3\DR3, 0x890f1a8, 3, \Device\MPIODisk0...} Binary : {0F01040004002C00000000009900048000000000000000000000000000000000000000000000000000000928, 0F01040004002C0000000000990004800000000000000000000000000000000000000000000000000000092A, 0F01040004002C00000000009900048000000000000000000000000000000000000000000000000000000988, 0F01040004002C00000000009900048000000000000000000000000000000000000000000000000000000928...}
My goal is to match each event (data) with each time (timecreated) and its binary code.
I would appreciate your input folks.