major update to override Write-Output func

This commit is contained in:
2023-10-05 13:11:38 -04:00
parent 31a06a9206
commit bbb4884818
52 changed files with 377 additions and 378 deletions
+7 -7
View File
@@ -8,15 +8,15 @@ $ExportedEvents = "${Env:TEMP}\${Env:COMPUTERNAME}_events.csv"
# Install Posh-SSH module
If ( !(Get-Module -ListAvailable -Name Posh-SSH) ) {
LogMsg "Installing Posh-SSH module"
Write-Output "Installing Posh-SSH module"
Install-Module -Name Posh-SSH -Force
}
# Cleanup previous runs
If ( Test-Path $ExportedEvents ) {
LogMsg "Deleting exported events from previous script run ""${ExportedEvents}"""
Write-Output "Deleting exported events from previous script run ""${ExportedEvents}"""
Try { Remove-Item $ExportedEvents -Force -ErrorAction Stop }
Catch { LogMsg "Cannot remove files from previous script execution. This script cannot run." ; Exit }
Catch { Write-Output "Cannot remove files from previous script execution. This script cannot run." ; Exit }
}
# Get all available log files
@@ -25,13 +25,13 @@ $Logs = Get-WinEvent -ListLog *
# Export all significant events from all available log files
ForEach ($Log in $Logs) {
$LogName = $Log.LogName
LogMsg "Exporting events from: ${LogName}"
Write-Output "Exporting events from: ${LogName}"
Try { Get-WinEvent -LogName $LogName -FilterXPath "Event/System[Level=1 or Level=2 or Level=3]" -ErrorAction Stop | Select LogName,ProviderName,Level,Id,Message | Export-Csv -Path "${ExportedEvents}" -Append -NoTypeInformation -ErrorAction Stop }
Catch { LogErr $_.Exception.Message }
}
# Deduplicate exported events
LogMsg "Deduplicating and sorting all exported events"
Write-Output "Deduplicating and sorting all exported events"
Try {
$TempEvents = Import-Csv $ExportedEvents -ErrorAction Stop | Sort-Object LogName,ProviderName,Id -Unique
$TempEvents | Sort-Object -Property LogName,ProviderName | Export-Csv $ExportedEvents -NoTypeInformation -ErrorAction Stop
@@ -48,7 +48,7 @@ If ( Test-Path $ExportedEvents ) {
# Make the connection and upload the file
$SFTPSession = New-SFTPSession -ComputerName $SFTPHost -Credential $SFTPCred -AcceptKey -Port $SFTPPort
LogMsg "Uploading events to SFTP site"
Write-Output "Uploading events to SFTP site"
Try { Set-SFTPItem -SessionId $SFTPSession.SessionId -Path $ExportedEvents -Destination . -Force }
Catch { LogErr $_.Exception.Message }
Finally { Remove-SFTPSession -SessionId $SFTPSession.SessionId }
@@ -56,5 +56,5 @@ If ( Test-Path $ExportedEvents ) {
}
# Cleanup
LogMsg "Deleting ""${ExportedEvents}"""
Write-Output "Deleting ""${ExportedEvents}"""
Remove-Item $ExportedEvents -Force -ErrorAction SilentlyContinue