PowerShell 技能连载 - 获取关机信息
原始链接:[url=http://blog.vichamp.com/powershell/tip/2014/08/20/getting-shutdown-information-testing/]PowerShell 技能连载 - 获取关机信息[/url]发表日期:2014-08-20
[hr]
[i]适用于 PowerShell 所有版本[/i]
Windows 在系统事件日志中记录了所有的关机事件。您可以从那儿提取和分析信息。
以下是一个读取适当的事件日志记录、从 ReplacementStrings 数组中读取相关的信息,并以对象数组的方式返回关机信息的函数。[code]
function Get-ShutdownInfo
{
Get-EventLog -LogName system -InstanceId 2147484722 -Source user32 |
ForEach-Object {
$result = 'dummy' | Select-Object -Property ComputerName, TimeWritten, User, Reason, Action, Executable
$result.TimeWritten = $_.TimeWritten
$result.User = $_.ReplacementStrings[6]
$result.Reason = $_.ReplacementStrings[2]
$result.Action = $_.ReplacementStrings[4]
$result.Executable = Split-Path -Path $_.ReplacementStrings[0] -Leaf
$result.ComputerName = $_.MachineName
$result
}
}
[/code]现在要检查关机问题就容易多了:[code]
PS> Get-ShutdownInfo | Out-GridView
[/code]本文国际来源:[url=http://powershell.com/cs/blogs/tips/archive/2014/08/20/getting-shutdown-information-testing.aspx]Getting Shutdown Information[/url]
页:
[1]