0
$ComputerName = "testserver"
$EventLogNames=@("System") 
$EventStartDate = (((Get-Date).addDays(-30)).date)
$EventEndTime = (Get-Date)

$EventCritea_Patch = @{logname = $EventLogNames; StartTime=$EventStartDate;     
EndTime=$EventEndTime; id=1074}

$events_patch = Get-WinEvent -ComputerName $ComputerName -FilterHashTable    
$EventCritea_Patch  -ErrorAction SilentlyContinue
Write-host  Count is $events_patch.count
$counts_patch = $events_patch.count
Write-host $counts_patch

它是一个 Powershell 代码片段,用于在 Windows 2008 服务器中查询事件查看器并返回发生次数

每当我运行此脚本时,如果我更改“ (((Get-Date).addDays(-30)).date)”,以便仅存在该事件 ID 的一个事件。我得到$events_patch.count0 而不是预期值 1。但是如果 Get-Event 写入了多个记录,那么我会得到正确的值$events_patch.count。请指教。

4

0 回答 0