过滤/匹配事件日志记录

Question

目标：创建一个脚本，该脚本从特定计算机获取最后一天的事件日志，然后查看消息部分以根据特定IP筛选数据（首先），然后仅对启动项与特定的关键字，然后输出到HTML。

代码：

$fileDate = (Get-Date -Format ddMMyyyy) + ".html" 
$EventGrab = Invoke-Command { 
    Get-EventLog -LogName Security -After (Get-Date).AddDays(-1) -EntryType FailureAudit 
} -ComputerName whatever 
$EventGrab | 
    Sort-Object -Property TimeWritten -Descending | 
    Select-String -InputObject {$_.TimeWritten,$_.message} -Pattern "10.1.2.13" | 
    ConvertTo-Html | 
    Out-File C:\$fileDate 

粗步：

1. 创建文件与日期。
2. 过去24小时内从安全日志中使用FailureAudit获取事件日志。
3. 检查上述模式（设备）的消息部分。
4. 转换为HTML和输出从第1步

问题是步骤3和4之间的日期到文件;我需要在第3步之后再次过滤消息，以便消息字段只查找特定语法（例如LTC），然后在数据发现到HTML文件时输出该数据。

我在想它只是另一个Select-String，或其他东西，但无法弄清楚。

实施例输入（@Select-String部分）：

02/08/2017 15:51:57 Network Policy Server denied access to a user. 
Contact the Network Policy Server administrator for more information. 
User: 
Security ID:     S-1-0-0 
Account Name:     <scrubbed> 
Account Domain:     <scrubbed> 
Fully Qualified Account Name: <scrubbed> 

Client Machine: 
Security ID:     S-1-0-0 
Account Name:     - 
Fully Qualified Account Name: - 
OS-Version:      - 
Called Station Identifier:  00-1B-53-41-5A-57 
Calling Station Identifier:  F8-CA-B8-57-1A-9B 

NAS: 
NAS IPv4 Address:    10.1.2.13 
NAS IPv6 Address:    - 
NAS Identifier:     - 
NAS Port-Type:     Ethernet 
NAS Port:      50324 

RADIUS Client: 
Client Friendly Name:   <scrubbed> 
Client IP Address:    10.1.2.13 

Authentication Details: 
Connection Request Policy Name: <scrubbed> 
Network Policy Name:   - 
Authentication Provider:  Windows 
Authentication Server:   <scrubbed> 
Authentication Type:   PEAP 
EAP Type:      Microsoft: Secured password (EAP-MSCHAP v2) 
Account Session Identifier:    - 
Logging Results:    Accounting information was written to the local log file. 
Reason Code:     8 
Reason:       The specified user account does not exist. 

预期输出：

上述改变，使得只有帐户名是host/LTC<whatever>。

Answer 1

使用Where-Object用于过滤记录和Select-String从消息中提取字符串：

$EventGrab | 
    Sort-Object -Property TimeWritten -Descending | 
    Where-Object { 
     $_.Message -like '*10.1.2.13*' -and 
     $_.Message -like '*LTC*' 
    } | 
    Select-Object TimeWritten, @{n='Account';e={ 
     Select-String -InputObject $_.Message -Pattern 'Account Name:\s+(.*LTC.*)' | 
      Select-Object -Expand Matches | 
      ForEach-Object { $_.Groups[1].Value } 
    }} | 
    ConvertTo-Html | 
    Out-File C:\$fileDate