Kategoria: Bez kategorii

This is part 2 of our mini-series covering PowerShell script block logging. Today, we’ll again read the script block logging log, but this time we’ll try and get back the log data in a more useful object-oriented way:

function Get-LoggedCode
{
    # read all raw events
    $logInfo = @{ ProviderName="Microsoft-Windows-PowerShell"; Id = 4104 }
    Get-WinEvent -FilterHashtable $logInfo | 
        # take each raw set of data...
        ForEach-Object {
            # create a new object and extract the interesting
            # parts from the raw data to compose a "cooked"
            # object with useful data
            [PSCustomObject]@{
                # when this was logged
                Time = $_.TimeCreated
                # script code that was logged
                Code = $_.Properties[2].Value
                # if code was split into multiple log entries,
                # determine current and total part
                PartCurrent = $_.Properties[0].Value
                PartTotal = $_.Properties[1].Value
                
                # if total part is 1, code is not fragmented
                IsMultiPart = $_.Properties[1].Value -ne 1
                # path of script file (this is empty for interactive
                # commands)
                Path = $_.Properties[4].Value
                # log level
                # by default, only level "Warning" will be logged
                Level = $_.LevelDisplayName
                # user who executed the code (SID)
                User = $_.UserId
            }
        } 
}

When you run this code, you now have a new command named Get-LoggedCode. When you execute it, it returns objects like this:

 
Time        : 25.05.2018 10:57:36
Code        : function Get-LoggedCode
              {
                  # read all raw events
                  $logInfo = @{ ProviderName="Microsoft-Windows-PowerShell"; Id = 4104 }
                  Get-WinEvent -FilterHashtable $logInfo | 
                      # take each raw set of data...
                      ForEach-Object {
                          # create a new object and extract the interesting
                          # parts from the raw data to compose a "cooked"
                          # object with useful data:
                          [PSCustomObject]@{
                              # when this was logged:
                              Time = $_.TimeCreated
                              # script code that was logged:
                              Code = $_.Properties[2].Value
                              # if code was split into multiple log entries,
                              # determine current and total part:
                              PartCurrent = $_.Properties[0].Value
                              PartTotal = $_.Properties[1].Value
                              
                              # if total part is 1, code is not fragmented:
                              IsMultiPart = $_.Properties[1].Value -ne 1
                              # path of script file (this is empty for interactive
                              # commands)
                              Path = $_.Properties[4].Value
                              # log level
                              # by default, only level "Warning" will be logged:
                              Level = $_.LevelDisplayName
                              # user who executed the code (SID)
                              User = $_.UserId
                          }
                      } 
              }
              
              
              
PartCurrent : 1
PartTotal   : 1
IsMultiPart : False
Path        : D:sample.ps1
Level       : Warning
User        : S-1-5-21-2012478179-265285931-690539891-1001 
 

In our example, we added “Select-Object” to not read the entire log but just the last entry. Here, we got back the code that we just executed. This may be different for you, and here is why:

By default, script block logging only logs code considered “security relevant” (in the returned data, Level is “Warning”). PowerShell determines internally which code is considered security relevant. In tomorrow’s tip, we will explain how you enable the “Verbose” mode. When this mode is turned on, any code is logged, so your log file grows in size considerably. Here is how you can check the ratio of default (“Warning”) logs versus verbose logs (taken from our test machine):

 
PS> Get-LoggedCode | Group-Object Level

Count Name                      Group                                                             
----- ----                      -----                                                             
  549 Verbose                   {@{Time=25.05.2018 10:57:52; Code=prompt;..
   36 Warning                   {@{Time=25.05.2018 10:57:52; Code={...   
 

Please note: Since log entries have a maximum size, long code is split up in chunks. The “IsMultiPart”, “PartCurrent”, and “PartTotal” properties provide information about this.

ReTweet this Tip!

Wyprzedaż butów New Balance na fitness trening.pl

https://www.skapiec.pl/zdjecia/skapiec-transfor…

Dron BAYANGTOYS X16 RTF w cenie 139,00$

Kod rabatowy:

nie jest potrzebny

Alternatywny kod:

BYX16O

Podstawowe informacje:
Brand: Bayangtoys
Type: Outdoor,Quadcopter
Model: X16
Features: Brushless Version,No camera,Radio Control
Motor Type: Brushless Motor
Functions: 3D rollover,Air Press Altitude Hold,Automatic Return,Forward/backward,Headless Mode,Height Holding,Hover,Sideward flight,Slow down,Speed up,Turn left/right,Up/down,With light
Size: Large
Satellite System: GPS
Max Flying Height: 1000m
Max Ascent Speed: 5m/s
Max Descent Speed: 3m/s
Hover Accuracy: 0.5 – 2m
Built-in Gyro: 6 Axis Gyro
Material: Electronic Components,Plastic
Kit Types: RTF
Level: Intermediate Level
Age: Above 14 years old

Zobacz ofertę