Powershell script to check Windows Event Logs for Critical messages

powershell

I have a powershell script that checks in the Application and System Windows Event logs for Errors. Is there away to also let it check for Critical messages? in the Windows Event Logs. Below is a sample script:

Set-Variable -Name EventAgeDays -Value 1     #we will take events for the latest 7 days
Set-Variable -Name CompArr -Value @("Server 1")   # replace it with your server names
Set-Variable -Name LogNames -Value @("Application", "System")  # Checking app and system logs
Set-Variable -Name EventTypes -Value @("Error")  # Loading only Errors and Warnings
Set-Variable -Name ExportFolder -Value "C:\EventLogs\"


$el_c = @()   #consolidated error log
$now=get-date
$startdate=$now.adddays(-$EventAgeDays)
$ExportFile=$ExportFolder + "el" + $now.ToString("yyyy-MM-dd---hh-mm-ss") + ".csv"  # we cannot use standard delimiteds like ":"

foreach($comp in $CompArr)
{
  foreach($log in $LogNames)
  {
    Write-Host Processing $comp\$log
    $el = get-eventlog -ComputerName $comp -log $log -After $startdate -EntryType $EventTypes
    $el_c += $el  #consolidating
  }
}
$el_sorted = $el_c | Sort-Object TimeGenerated    #sort by time
Write-Host Exporting to $ExportFile
$el_sorted|Select EntryType, TimeGenerated, Source, EventID, MachineName, Message | Export-CSV $ExportFile -NoTypeInfo  #EXPORT
Write-Host Done!

Best Answer

Set-Variable -Name EventAgeDays -Value 1     #we will take events for the latest 7 days
    Set-Variable -Name CompArr -Value @("localhost")   # replace it with your server names
    Set-Variable -Name LogNames -Value @("Application", "System")  # Checking app and system logs
    Set-Variable -Name EventTypes -Value @("1")  # Loading only Errors and Warnings
    Set-Variable -Name ExportFolder -Value "C:\EventLogs\"


    $el_c = @()   #consolidated error log
    $now=get-date
    $startdate=$now.adddays(-$EventAgeDays)
    $ExportFile=$ExportFolder + "el" + $now.ToString("yyyy-MM-dd---hh-mm-ss") + ".csv"  # we cannot use standard delimiteds like ":"

    foreach($comp in $CompArr)
    {
      foreach($log in $LogNames)
      {
        Write-Host Processing $comp\$log
        $el = get-winevent -ComputerName $comp -FilterHashtable @{logname="$log";level=$eventtypes;starttime=$startdate}
        $el_c += $el  #consolidating
      }
    }
    $el_sorted = $el_c | Sort-Object TimeGenerated    #sort by time
    #Write-Host Exporting to $ExportFile
    $el_sorted|Select LevelDisplayName, TimeCreated, ProviderName, ID, MachineName, Message 

You can change "eventtypes" to 1,2,3,4 (critical,error,warning,information)