Created
January 10, 2024 17:01
-
-
Save figueroadavid/db32abd5f83ee103e7fab77f847bff83 to your computer and use it in GitHub Desktop.
Test-EventSource tests a list of machine for a list of eventsources
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| function Test-EventSource { | |
| <# | |
| .SYNOPSIS | |
| Tests for event sources against a list of computers | |
| .DESCRIPTION | |
| The function uses the [System.Diagnostics.EventLog] object to test the presence of | |
| each event source on each computer | |
| .PARAMETER EventSource | |
| The list of EventSources to check | |
| .PARAMETER ComputerName | |
| The list of ComputerNames to check the EventSources against | |
| .EXAMPLE | |
| PS C:\> Test-EventSource -EventSource 'This is a test',scecli | |
| Name ComputerName Exists | |
| ---- ------------ ------ | |
| This is a test SYSTEM01 False | |
| scecli SYSTEM01 False | |
| .EXAMPLE | |
| Test-EventSource -EventSource edgeupdate,scecli -ComputerName Server01,Server02 | |
| Name ComputerName Exists | |
| ---- ------------ ------ | |
| edgeupdate Server01 True | |
| scecli Server01 True | |
| edgeupdate Server02 False | |
| scecli Server02 True | |
| .NOTES | |
| This function only detects the explicit sources in the registry keys for the eventlogs. | |
| The sources are the registry keys underneath each specific log in the registry key | |
| HKLM\SYSTEM\CurrentControlSet\Services\EventLog\<logname> | |
| Event sources that do not exist under a specific log may return an invalid false. | |
| See the gist for Test-EventSourceByLog that can test an individual log. | |
| Thanks to santisq for the base code that it was derived from. | |
| #> | |
| [cmdletbinding()] | |
| param( | |
| [parameter(Mandatory,ValueFromPipelineByPropertyName,ValueFromPipeline)] | |
| [string[]]$EventSource, | |
| [parameter(ValueFromPipelineByPropertyName)] | |
| [string[]]$ComputerName = $env:COMPUTERNAME | |
| ) | |
| foreach ($Computer in $ComputerName) { | |
| foreach ($Source in $EventSource) { | |
| $SourceExists = try { | |
| [System.Diagnostics.EventLog]::SourceExists($Source, $Computer) | |
| } | |
| catch { | |
| $false | |
| } | |
| [PSCustomObject]@{ | |
| Name = $Source | |
| ComputerName = $Computer | |
| Exists = $SourceExists | |
| } | |
| } | |
| } | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment