1

I searched through the answers already on here, but didn't find anything I could say definitively answered my question. I have a script that should reach out to several servers as defined by a text file and report details from the EventLog. It also writes out to a file, emails the resulting file as an attachment, and gives me the amount of time it took to process the command, just so I can monitor the overall performance and see if there are any changes over time. That part works just fine.

Write-Output ($Start = Get-Date) | Out-File -Append F:\PowerShell\UnExpectedShutdowns.txt
$Computers = Get-Content -Path F:\PowerShell\servers.txt
Get-EventLog -logname System -ComputerName $Computers | ? {$_.TimeWritten -gt $lasttime -and $_.EventID -eq "6008"} | Format-Table -Wrap -Property MachineName, Index, TimeGenerated, EntryType, Source, InstanceID, Message -AutoSize | Out-File -Append -Force F:\PowerShell\UnExpectedShutdowns.txt
Write-Output (($Stop = Get-Date) - $Start).TotalSeconds | Out-File -Append F:\PowerShell\UnExpectedShutdowns.txt
Send-MailMessage -From sender@emaildomain.com -Subject "Daily Check for Server Shutdowns" -To receiver@emaildomain.com -Attachments F:\PowerShell\UnExpectedShutdowns.txt -Body "<p style=""font-family: Verdana, Geneva, sans-serif; font-size: 12px;"">Please review the attached document for new unexpected server shutdowns. </p><p>&nbsp;</p><p style=""font-family: Verdana, Geneva, sans-serif; font-size: 12px;"">The original file is located on <a href=""file:///\\SERVER\F$\Powershell\UnExpectedShutdowns.txt"">\\SERVER\F$\Powershell\UnExpectedShutdowns.txt</a></p><p style=""font-family: Verdana, Geneva, sans-serif; font-size: 12px;"">It should be pared down from time to time to maintain its size</p>" -BodyAsHtml -Priority Normal -SmtpServer smtp.dept.domain.com

I've added this as a scheduled task. If I Run outside of Task Scheduler manually, I get the results I expect.

MachineName                      Index TimeGenerated          EntryType Source   InstanceId Message                                                                     
-----------                      ----- -------------          --------- ------   ---------- -------                                                                     
SERVERNAME9999.fqdn             123456 3/10/2016 11:11:46 AM      Error EventLog 1234567890 The previous system shutdown at 11:08:17 AM on ‎3/‎10/‎2016 was unexpected.

However, when I let it run on the schedule, I get results minus the last 2 columns (InstanceID & Message)

MachineName                      Index TimeGenerated          EntryType Source 
-----------                      ----- -------------          --------- ------ 
SERVERNAME9999.fqdn             123456 3/10/2016 11:11:46 AM      Error EventLo
                                                                        g

As a scheduled task, I run it with an account that is in the administrator's group for all servers and I have the "Run with highest privileges" option checked. Why are my last 2 columns missing?

4

1 回答 1

1

就像 nkasco 所说，输出到文件时使用Select而不是。Format-Table这可能是由于在Format-Table另一个用户下作为计划任务运行时，我认为它不能正确计算控制台大小并且它正在切断列以适应。除非您打算将结果直接输出到屏幕，否则不应使用。-AutoSize-WrapFormat-Table

此外，-After在您的服务器中使用，Get-EventLog以便每个服务器只返回所需的日期范围，而不是通过网络传递整个事件日志，然后强制 PowerShell 从那里过滤所有内容。

Get-EventLog -logname System -ComputerName $Computers -After $lasttime | ? {$_.EventID -eq "6008"} | Select MachineName, Index, TimeGenerated, EntryType, Source, InstanceID, Message | Out-File -Append -Force F:\PowerShell\UnExpectedShutdowns.txt
于 2016-04-11T20:04:47.623 回答