Monitoring events using event viewer tool

[Perrypackettracer]

Monitoring event logs using the Event Viewer tool involves creating a scheduled task that triggers the collection of specific events. Below is a PowerShell script that automates the monitoring of event logs using the Event Viewer:

# Define the event log parameters
$LogName = "System"
$EventLevel = "Error"  # You can change this to "Warning" or "Information" as needed
$EventID = 1001  # Specify the Event ID(s) you want to monitor

# Specify the output directory for log collection
$OutputDirectory = "C:\Path\To\EventLogs"
$OutputFileName = "EventLogCollection.csv"
$OutputFilePath = Join-Path -Path $OutputDirectory -ChildPath $OutputFileName

# Create the output directory if it doesn't exist
if (-not (Test-Path -Path $OutputDirectory)) {
    New-Item -ItemType Directory -Path $OutputDirectory
}

# Clear existing event log entries (uncomment if needed)
# Clear-EventLog -LogName $LogName

# Get events from the specified log based on criteria
$Events = Get-WinEvent -LogName $LogName -FilterHashtable @{
    Level = $EventLevel
    ID = $EventID
} | Select-Object TimeCreated, Id, Message

# Export events to CSV file
$Events | Export-Csv -Path $OutputFilePath -NoTypeInformation

Write-Host "Event log entries exported to: $OutputFilePath"

Explanation:

1. Modify the event log parameters ($LogName, $EventLevel, $EventID) according to your monitoring criteria.

2. Specify the $OutputDirectory where the script will save the exported event log entries in a CSV file named $OutputFileName.

3. The script creates the output directory if it doesn't exist.

4. Optionally, you can uncomment the Clear-EventLog line to clear existing entries from the event log before collecting new ones. Be cautious when using this, as it clears all entries in the specified log.

5. The script uses Get-WinEvent to retrieve events from the specified log based on the defined criteria.

6. The selected event properties (TimeCreated, Id, Message) are exported to a CSV file using Export-Csv.

7. Customize the script based on your specific monitoring criteria, execute it periodically (e.g., using Task Scheduler), and review the exported CSV file for event log details.