I'm struggling to create an event based PowerShell script to continiously monitor certain events that are happening on a computer.
First of all, I tried to base my script on a snippet I found online (see the code under this text).
I noticed the use of '[System.Diagnostics.EventLog]' which is OK if you use 'old' logs like 'System', 'Application'..,
but this doesn't work for 'new' log files like 'Microsoft-Windows-Wired-AutoConfig/Operational' where I'm looking for ID's 15500 and 15501
(Using 'Get-EventLog' doesn't show this log, but 'Get-WinEvent' does)
So I've been trying different things but I can't figure out how to get this working for the 'new' logfiles.
Anyone has any idea?
# set the event log name you want to subscribe to
# (use Get-EventLog -AsString for a list of available event log names)
$Name = 'Application'
# get an instance
$Log = [System.Diagnostics.EventLog]$Name
# determine what to do when an event occurs
$Action = {
# get the original event entry that triggered the event
$entry = $event.SourceEventArgs.Entry
# do something based on the event
if ($entry.EventId -eq 1 -and $entry.Source -eq 'WinLogon')
{
Write-Host "Test event was received!"
}
}
# subscribe to its "EntryWritten" event
$job = Register-ObjectEvent -InputObject $log -EventName EntryWritten -SourceIdentifier 'NewEventHandler' -Action $Action
# use a loop to keep PowerShell busy. You can abort via CTRL+C
Write-Host "Listening to events" -NoNewline
try
{
do
{
Wait-Event -SourceIdentifier NewEventHandler -Timeout 1
Write-Host "." -NoNewline
} while ($true)
}
finally
{
# this executes when CTRL+C is pressed
Unregister-Event -SourceIdentifier NewEventHandler
Remove-Job -Name NewEventHandler
Write-Host ""
Write-Host "Event handler stopped."
}
