For some reason, when I try to use the security option, it does not actually execute the get-eventlog cmdlet, but writes it to the screen as though it were quoted. The other logs work without the try catch block, but whenever I set them up with the try catch block, they still function as though the cmdlet were quoted.
$eventlogname = Read-Host "Which event log category do wish to view? Enter Application, Security, Setup, System, or Forwarded events"
$lognumber = Read-Host "Enter the number of logs you wish to retrieve"
switch
($eventlogname)
{
Security {
$logseverity = Read-Host "What event severity do you wish to view? Enter Critical, Warning, Error, FailureAudit, SuccessAudit, or Information"
$computernameeventlog = Read-Host "Please enter the hostname to query"
if ($computernameeventlog -eq "localhost" )
{
try
{
{
Get-EventLog -logname $eventlogname -EntryType $logseverity -Newest $lognumber -ErrorAction SilentlyContinue
}
}
catch [System.IO.IOException]
{
Write-Host "The hostname was incorrect or not available."
}
catch [System.InvalidOperationException]
{
Write-Host "The event log does not exist"
}
}
else
{
try{
{
Get-EventLog -logname $eventlogname -EntryType $logseverity -ComputerName $computernameeventlog -Newest $lognumber -ErrorAction SilentlyContinue
}
}
catch [System.IO.IOException]
{
Write-Host "The hostname was incorrect or not available."
}
catch [System.InvalidOperationException]
{
Write-Host "The event log does not exist"
}
}
}
"Forwarded events"
{
$computernamewinevent = Read-Host "Please enter the hostname to query"
$logseverity = Read-Host "What event severity do you wish to view? Enter Critical, Warning, Error or Information"
if ($computernamewinevent -eq "localhost")
{
Get-WinEvent -logname forwardedevents -MaxEvents $lognumber | where {$_.leveldisplayname -contains $logseverity}
}
else
{
Get-WinEvent -logname forwardedevents -MaxEvents $lognumber -ComputerName $computername | where {$_.leveldisplayname -contains $logseverity}
}
}
default
{
$logseverity = Read-Host "What event severity do you wish to view? Enter Critical, Warning, Error or Information"
$computernameeventlog = Read-Host "Please enter the hostname to query"
if ($computernameeventlog -eq "localhost" )
{
Get-EventLog -logname $eventlogname -EntryType $logseverity -Newest $lognumber
}
else
{
Get-EventLog -logname $eventlogname -EntryType $logseverity -ComputerName $computernameeventlog -Newest $lognumber
}
}
}
In your code you have surrounded the command with brackets ({
}
) such as this:
{
Get-EventLog -logname $eventlogname -EntryType $logseverity -ComputerName $computernameeventlog -Newest $lognumber -ErrorAction SilentlyContinue
}
This will produce a script block, which will not execute but output as a string. What you want is remove the brackets.