我想為以下事件 id 訊息決議一些關鍵字。我怎樣才能做到這一點 ？
Get-WinEvent -FilterHashtable @{LogName='System';ID='10036'} -MaxEvents 5 | fl TimeCreated,Message
TimeCreated : 6/22/2022 9:41:24 AM
Message : The server-side authentication level policy does not allow the user CONTOSO\user01 SID (S-1-5-21-609545082-2795152396-2074981628-18664) from address
10.223.13.11 to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application.
事件 ID 10036 訊息：
The server-side authentication level policy does not allow the user CONTOSO\user01 SID (S-1-5-21-609545082-2795152396-2074981628-18664) from address 10.223.13.11 to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application.
我想要的輸出：
User;Address
CONTOSO\user01;10.223.13.11
CONTOSO\user31;10.222.13.34
uj5u.com熱心網友回復：
我的系統上沒有任何這些事件，因此無法正確測驗它，但它應該可以滿足您的需求：
Get-WinEvent -FilterHashtable @{LogName='System';ID='10036'} -MaxEvents 5 |
ForEach-Object {
if($_.message -match 'user (?<user>[\w\\] ) . address (?<address>[\d \.] ). ') {
[PsCustomObject]@{
TimeCreated = $_.TimeCreated
User = $Matches.user
Address = $Matches.address
}
}
}
這將為每個事件條目輸出一個自定義物件。在表格格式中，它將如下所示：
TimeCreated User Address
----------- ---- -------
6/22/2022 9:41:24 AM CONTOSO\user01 10.223.13.11
6/22/2022 10:30:16 AM CONTOSO\user31 10.222.13.34
如果您希望它采用您提到的 CSV 格式，請將其附加在最后的大括號之后：| ConvertTo-Csv -Delimiter ';'. TimeCreated = $_.TimeCreated如果您真的不想要它，請從自定義物件中洗掉。
轉載請註明出處，本文鏈接：https://www.uj5u.com/net/495222.html
標籤：电源外壳