원격 서버 이벤트로그를 파일로 저장

#requires -version 3.0

 

#remote computers must be running PowerShell 3.0

 

$computers = "dc01","ex16","c1","ex10"    -- 서버명

$cred = Get-Credential "mani4u\administrator"   -- 관리자암호

$eventlog = "Application"     -- 추출 할 이벤트로그명

 

invoke-command -ScriptBlock {

  $log = get-wmiobject win32_nteventlogfile -filter "logfilename = '$using:eventlog'"

  $file = "{0}_{1}_{2}.evtx" -f (get-date -f "yyyyMMdd"),$log.CSName,$log.FileName.Replace(" ","")

 

  #map a PSDrive with credentials

  New-PSDrive -name B -PSProvider Filesystem -Root \\ex10\it -Credential $using:cred | Out-Null  --지정서버명\공유폴더명

 

  #backup path must be something Windows can see like a UNC

  $backup = join-path (get-psdrive B).root $file

  write-host "Backing up to $backup" -ForegroundColor cyan

  $r = $log | Invoke-WmiMethod -Name BackupEventlog -ArgumentList $backup

  if ($r.returnValue -eq 0) {

    Get-Item $backup

  }

  else {

   Throw "Backup failed with returnvalue $($r.returnvalue)"

  }

 

 } -ComputerName $computers