Better Event Logs with PowerShell

Because I don't work in a corporate environment, I don't always see opportunities where PowerShell can make your life better as an IT professional. I have a friend -- let's call her Gladys Kravitz. Gladys and I were chatting and she mentioned how tricky it is to pull information out of Windows event logs. If I recall, she was looking at 4625 events in the Security log which represents failed logon attempts. Here's an example:

Reading the message it is clear that user Aprils in the Company domain tried to logon to Win10. But how would you get that information from event logs on 100 of machines? You could resort to some regular expression voodoo to extract the information. The values are actually part of the event log record. You may have seen ReplacementStrings when using Get-Eventlog. When using Get-WinEvent these values are stored as properties.

Assuming these values were consistent, you could write a function to create a custom object from these values. But I'm always thinking of the bigger picture. What Gladys really wanted is a way to turn the event log record into a structured object she could use in PowerShell. This issue with replacement strings goes beyond this particular situation.

XML to the Rescue

You probably don't think of XML as a solution, but in this case, it XML saves the day. The event log record object you get from Get-WinEvent includes a method to create an XML version.

 $r = get-winevent -FilterHashtable @{Logname="Security";ID=4625} -MaxEvents 1 -ComputerName Win10 [xml]$evt = $r.ToXml() 

This document has properties that expose the data used to construct the event log record.

The Data node looks promising.

That almost looks like an object! I'll make one.

$evt.Event.EventData.Data | foreach-object -Begin {$h = @{}} -Process {
 $h.add($_.name,$_.'#text')
} -end { $obj = New-Object -TypeName PSObject -Property $h }

I can build a tool around this to convert event log records into more meaningful objects. And that's exactly what I did for Gladys.

Convert-EventLogRecord

I wrote a function called Convert-EventLogRecord that is part of the latest release of my PSScriptTools module. The function is designed to convert event log entries into custom objects. The function creates a custom object with the data properties I showed, but other information as well such as event id, log name and computername.

Now Gladys has a PowerShell tool to get the information she wants in the form she wants.

This isn't a perfect tool. Some even log entries don't have extra data. Or the data they have is just a list of strings. In those cases, the data is stored as RawProperties.

But once I know that I can write a control script or other tooling.

As you explore different events in different logs you figure out what things look like. Sometimes the event log data isn't helpful. But with a little PowerShell effort on your part, you can create meaningful results. You should be able to run this code on your desktop.

Get-WinEvent -FilterHashtable @{Logname ='system';ID =7040} -MaxEvent 50 |
Convert-EventlogRecord | 
Sort-Object -Property Param4,TimeCreated -Descending |
Format-Table -GroupBy @{Name="Service";Expression={$_.param4}} -Property TimeCreated,
@{Name="OriginalState";Expression = {$_.param2}},
@{Name="NewState";Expression={$_.param3}},Computername

The results show you when services changed state.

I've been showing results as formatted tables. But you can do whatever you want because the Convert-EventLogRecord function is writing an object to the pipeline. Run whatever Get-Winevent query or command you want, convert the results, and then do what you need to with the results.

I gave the code to Gladys to try out but now you can get it as well in the PSScriptTools module, beginning with version 2.13. I hope you'll give it a try and let me know what you think.