Skip to content

Instantly share code, notes, and snippets.

@et0x
Created August 23, 2016 03:29
Show Gist options
  • Save et0x/8d0f279dc6a4547bc990918cf1f661f9 to your computer and use it in GitHub Desktop.
Save et0x/8d0f279dc6a4547bc990918cf1f661f9 to your computer and use it in GitHub Desktop.
function Register-NewEventWatchers
{
[CmdletBinding()]
Param(
[Parameter(Mandatory=$true)]
[String]$CSVFolder
)
$logNames = (Get-EventLog -LogName *).Log
foreach ($logName in $logNames)
{
$logName = $logName.Trim()
$csvPath = [system.io.path]::Combine($CSVFolder, "$($logName).csv")
$action = {
Get-EventLog -LogName System -Newest 1 `
| Export-Csv -NoTypeInformation `
-Path "$csvPath" `
-Append
}
Register-ObjectEvent -InputObject $log -EventName EntryWritten -Action $action
$log = New-Object System.Diagnostics.EventLog -ArgumentList @("$logName")
$handler = Register-ObjectEvent -InputObject $log -SourceIdentifier "$($logName)EntryWritten" -EventName EntryWritten -Action $action -ErrorAction SilentlyContinue
}
}
function Unregister-NewEventWatchers
{
$logNames = (Get-EventLog -LogName *).Log
foreach ($logName in $logNames)
{
Unregister-Event -SourceIdentifier "$($logName)EntryWritten"
Get-Job | Stop-Job -ErrorAction SilentlyContinue
Get-Job | Remove-Job -ErrorAction SilentlyContinue
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment