$a = get-eventlog -logname system -message *SQL* -newest 1
$a | select-object -property *
-------------------------------------------------------------------------------------------------------------
EventID : 7036
MachineName : ABCD
Data : {83, 0, 81, 0...}
Index : 4281381
Category : (0)
CategoryNumber : 0
EntryType : Information
Message : The SQL Server Agent (MSSQLSERVER) service entered the stopped state.
Source : Service Control Manager
ReplacementStrings : {SQL Server Agent (MSSQLSERVER), stopped}
InstanceId : 1073748860
TimeGenerated : 11/22/2021 7:49:58 PM
TimeWritten : 11/22/2021 7:49:58 PM
UserName :
========================================================================
Get the Logon time info:
$a = Get-EventLog system -after (get-date).AddDays(-1) | where {$_.InstanceId -eq 7001}
$a | select-object -property *
-------------------------------------------------------------------------------------------------------
EventID : 7001
MachineName : abcd.com
Data : {}
Index : 3822944
Category : (1101)
CategoryNumber : 1101
EntryType : Information
Message : User Logon Notification for Customer Experience Improvement Program
Source : Microsoft-Windows-Winlogon
ReplacementStrings : {5, S-1-5-21-3838204708-2273163848-3117815430-1392}
InstanceId : 7001
TimeGenerated : 12/5/2021 7:19:10 PM
TimeWritten : 12/5/2021 7:19:10 PM
UserName : NT AUTHORITY\SYSTEM
Site :
Container :
-------------------------------------------------------------------------------------------------------
EventID : 7001
MachineName : abcd.com
Data : {}
Index : 3822900
Category : (1101)
CategoryNumber : 1101
EntryType : Information
Message : User Logon Notification for Customer Experience Improvement Program
Source : Microsoft-Windows-Winlogon
ReplacementStrings : {4, S-1-5-21-3838204708-2273163848-3117815430-2741}
InstanceId : 7001
TimeGenerated : 12/5/2021 6:43:09 PM
TimeWritten : 12/5/2021 6:43:09 PM
UserName : NT AUTHORITY\SYSTEM
Site :
Container :
-------------------------------------------------------------------------------------------------------
No comments:
Post a Comment
If you have any doubt or question, please contact us.