PoshCode Archive  Artifact [13fa391df8]

Artifact 13fa391df8686662af598b5dd8d6596327372409941cf408432a8060826cf205:

• File Export-ASP-Events-2-evtx.ps1 — part of check-in [cb62e84930] at 2018-06-10 13:34:18 on branch trunk — Export all ASP generated events in the application event log to a .evtx file. Note that a separate file will be made for each “provider” or .Net version installed. (user: anonymous size: 1017)

# encoding: ascii
# api: powershell
# title: Export ASP Events 2 evtx
# description: Export all ASP generated events in the application event log to a .evtx file. Note that a separate file will be made for each “provider” or .Net version installed.
# version: 0.1
# author: anonymous
# license: CC0
# x-poshcode-id: 3999
# x-archived: 2013-03-10T11:04:55
# x-published: 2013-03-06T20:45:00
#
#
# Be sure to include the tailing backslash "\"
$DstFolder = "D:\somefolder\"

$EvtSession = New-Object System.Diagnostics.Eventing.Reader.EventLogSession($env:computername)

[string[]] $ProviderList = $EvtSession.GetProviderNames() | Select-String asp

for($i=0;$i -lt $ProviderList.Length;$i++){
    $EvtQuery = "*[System/Provider/@Name=`""+$ProviderList[$i]+"`"]"
    $Dst = $DstFolder+$env:computername+"_"+($ProviderList[$i]).replace(" ","_")+".evtx"
    if(Test-Path -Path $Dst){Remove-Item -Path $Dst -Force}
    $EvtSession.ExportLogAndMessages('Application','LogName',$EvtQuery,$Dst)
}