Skip to content

Instantly share code, notes, and snippets.

@figueroadavid
Created January 10, 2024 17:38
Show Gist options
  • Save figueroadavid/66d2fe1183406cb09a977bd4e122a373 to your computer and use it in GitHub Desktop.
Save figueroadavid/66d2fe1183406cb09a977bd4e122a373 to your computer and use it in GitHub Desktop.
Test multiple logs for different event sources that may or may not be in the registry keys
function Test-EventSourceByLog {
<#
.SYNOPSIS
This tests for multiple sources in multiple eventlogs
.DESCRIPTION
This works regardless of if it exists directly in registry or not.
This is different than the Test-EventSource which uses a dotnet function
to check for all the sources that are directly listed in the registry.
.PARAMETER EventSource
The list of eventsources to check
.PARAMETER LogName
The list of eventlogs to check
.EXAMPLE
PS C:\> Test-EventSourceByLog -EventSource gupdate,egdgeupdate,drftesting -LogName Application
Name Log Exists
---- --- ------
gupdate Application True
egdgeupdate Application False
drftesting Application False
.EXAMPLE
PS C:\> Test-EventSourceByLog -EventSource gupdate,egdgeupdate,'service control manager' -LogName Application,System
Name Log Exists
---- --- ------
gupdate Application True
egdgeupdate Application False
service control manager Application False
gupdate System False
egdgeupdate System False
service control manager System True
.NOTES
The primary functional code came from Santiago Squarzon (https://github.com/santisq)
#>
param(
[parameter(Mandatory,ValueFromPipelineByPropertyName,ValueFromPipeline)]
[string[]]$EventSource,
[parameter(Mandatory, ValueFromPipelineByPropertyName, ValueFromPipeline)]
[string[]]$LogName
)
foreach ($Log in $LogName) {
foreach ($Source in $EventSource) {
$SourceLog = $Log
try {
$filter = "*[System/Provider/@Name='$Source']"
$reader = [System.Diagnostics.Eventing.Reader.EventLogReader]::new(
[System.Diagnostics.Eventing.Reader.EventLogQuery]::new(
$Log,
[System.Diagnostics.Eventing.Reader.PathType]::LogName,
$filter))
$SourceFound = $reader.ReadEvent() -as [bool]
}
finally {
if ($reader) { $reader.Dispose() }
}
[PSCustomObject]@{
Name = $Source
Log = $SourceLog
Exists = $SourceFound
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment