在Powershell中使用事件日志

我试图从Windows安全日志中分析logging，并且有些难以从某些login/注销事件中获取特定值。让我们来看一个具体的例子 – 这里是一个日志条目的XML。

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'> <System> <Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/> <EventID>4634</EventID> <Version>0</Version> <Level>0</Level> <Task>12545</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime='2011-08-16T17:15:38.702857400Z'/> <EventRecordID>107947</EventRecordID> <Correlation/> <Execution ProcessID='680' ThreadID='972'/> <Channel>Security</Channel> <Computer>SRV1.DOMAIN.LOCAL</Computer><Security/> </System> <EventData> <Data Name='TargetUserSid'>S-1-5-21-963414502-3093649508-813756320-3274</Data> <Data Name='TargetUserName'>billgates</Data> <Data Name='TargetDomainName'>MYDOMAIN</Data> <Data Name='TargetLogonId'>0x1c01acc</Data> <Data Name='LogonType'>10</Data> </EventData> </Event>

我将如何去提取存储在Data节点中的Name属性等于'TargetLogonId' ？

确保你的string是有效的XML（即将</Event>添加到上面发布的内容的末尾，然后将该string转换为XML：

 $xml = [xml]$yourStringHere

然后你可以像这样取出TargetLogonId：

 $xml.Event.SelectSingleNode("//*[@Name='TargetLogonId']") | select -ExpandProperty '#text'

感谢Shay Levy和这篇文章： http : //social.technet.microsoft.com/Forums/en/ITCG/thread/5aa133b0-ea69-4348-9bac-d028ba895024

如果仅给出原始XML，则可以加载XML文档。由于您发布了一个XML片段，因此我将假定它是从日志中导出的，并具有<Events>根标记。棘手的部分是命名空间。

 $xml = [xml](get-content "PathToXml.xml") $xmlns = New-Object -TypeName System.Xml.XmlNamespaceManager -ArgumentList $xml.NameTable $xmlns.AddNamespace("el", "http://schemas.microsoft.com/win/2004/08/events/event") $value = $xml.SelectSingleNode("/Events/el:Event/el:EventData/el:Data[@Name = 'TargetLogonId']/text()", $xmlns).Value

我用的XML：

 <?xml version="1.0" encoding="utf-8" standalone="yes"?> <Events> <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'> <System> <Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/> <EventID>4634</EventID> <Version>0</Version> <Level>0</Level> <Task>12545</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime='2011-08-16T17:15:38.702857400Z'/> <EventRecordID>107947</EventRecordID> <Correlation/> <Execution ProcessID='680' ThreadID='972'/> <Channel>Security</Channel> <Computer>SRV1.DOMAIN.LOCAL</Computer><Security/> </System> <EventData> <Data Name='TargetUserSid'>S-1-5-21-963414502-3093649508-813756320-3274</Data> <Data Name='TargetUserName'>billgates</Data> <Data Name='TargetDomainName'>MYDOMAIN</Data> <Data Name='TargetLogonId'>0x1c01acc</Data> <Data Name='LogonType'>10</Data> </EventData> </Event> </Events>

获取事件日志条目的XML：

 Get-WInEvent ‹parameters to select the events› | Foreach-Object { $_.ToXml() }

然后使用其他答案中显示的技术来提取特定的<Data>值。