Voici mon script pour exporter les données d'un Custom View dans l'Event Viewer via les données XML.
set-executionpolicy unrestricted
[xml]$CustomView = @"
<QueryList>
<Query Id="0" Path="Application">
<Select Path="Application">*[System[(EventID=4752 or EventID=4720 or EventID=4740 or EventID=4646 or EventID=4747 or EventID=4725 or EventID=4625 or EventID=4728 or EventID=4751)]]</Select>
<Select Path="Security">*[System[(EventID=4752 or EventID=4720 or EventID=4740 or EventID=4646 or EventID=4747 or EventID=4725 or EventID=4625 or EventID=4728 or EventID=4751)]]</Select>
<Select Path="Setup">*[System[(EventID=4752 or EventID=4720 or EventID=4740 or EventID=4646 or EventID=4747 or EventID=4725 or EventID=4625 or EventID=4728 or EventID=4751)]]</Select>
<Select Path="System">*[System[(EventID=4752 or EventID=4720 or EventID=4740 or EventID=4646 or EventID=4747 or EventID=4725 or EventID=4625 or EventID=4728 or EventID=4751)]]</Select>
<Select Path="ForwardedEvents">*[System[(EventID=4752 or EventID=4720 or EventID=4740 or EventID=4646 or EventID=4747 or EventID=4725 or EventID=4625 or EventID=4728 or EventID=4751)]]</Select>
Alot of rules etc... I excluded a couple because it was 300000 characters limited.
</Query>
</QueryList>
"@
Get-WinEvent -FilterXML $CustomView | Export-CSV "C:\LogFiles\ServiceTool_Log_$(Get-Date -format "yyyy-MM-dd").log"Comment puis-je exporter mon journal au format .evtx ou .csv pour le rendre lisible par l'homme ?
