Skip to content

Instantly share code, notes, and snippets.

@figueroadavid
Created January 10, 2024 17:01
Show Gist options
  • Select an option

  • Save figueroadavid/db32abd5f83ee103e7fab77f847bff83 to your computer and use it in GitHub Desktop.

Select an option

Save figueroadavid/db32abd5f83ee103e7fab77f847bff83 to your computer and use it in GitHub Desktop.
Test-EventSource tests a list of machine for a list of eventsources
function Test-EventSource {
<#
.SYNOPSIS
Tests for event sources against a list of computers
.DESCRIPTION
The function uses the [System.Diagnostics.EventLog] object to test the presence of
each event source on each computer
.PARAMETER EventSource
The list of EventSources to check
.PARAMETER ComputerName
The list of ComputerNames to check the EventSources against
.EXAMPLE
PS C:\> Test-EventSource -EventSource 'This is a test',scecli
Name ComputerName Exists
---- ------------ ------
This is a test SYSTEM01 False
scecli SYSTEM01 False
.EXAMPLE
Test-EventSource -EventSource edgeupdate,scecli -ComputerName Server01,Server02
Name ComputerName Exists
---- ------------ ------
edgeupdate Server01 True
scecli Server01 True
edgeupdate Server02 False
scecli Server02 True
.NOTES
This function only detects the explicit sources in the registry keys for the eventlogs.
The sources are the registry keys underneath each specific log in the registry key
HKLM\SYSTEM\CurrentControlSet\Services\EventLog\<logname>
Event sources that do not exist under a specific log may return an invalid false.
See the gist for Test-EventSourceByLog that can test an individual log.
Thanks to santisq for the base code that it was derived from.
#>
[cmdletbinding()]
param(
[parameter(Mandatory,ValueFromPipelineByPropertyName,ValueFromPipeline)]
[string[]]$EventSource,
[parameter(ValueFromPipelineByPropertyName)]
[string[]]$ComputerName = $env:COMPUTERNAME
)
foreach ($Computer in $ComputerName) {
foreach ($Source in $EventSource) {
$SourceExists = try {
[System.Diagnostics.EventLog]::SourceExists($Source, $Computer)
}
catch {
$false
}
[PSCustomObject]@{
Name = $Source
ComputerName = $Computer
Exists = $SourceExists
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment