Powershell Limit-Eventlog로 Windows 로그의 최대 크기 설정

Question

모든 Windows 로그의 기본 크기 증가를 스크립팅하고 다른 속성을 변경합니다. wevtutil을 사용했지만 2016 년에는이 기능을 사용할 수 없으므로 Powershell의 Limit-Eventlog으로 전환되었습니다. 최신 Windows Server 2016이 최신 업데이트로 설치됩니다. 기본 로그 속성

시작 :

PS> Get-Eventlog -List 

+--------+--------+-------------------+---------+------------------------+ 
| Max(K) | Retain | OverflowAction | Entries |   Log   | 
+--------+--------+-------------------+---------+------------------------+ 
| 300 |  0 | OverwriteAsNeeded | 2,599 | Application   | 
| 20,480 |  0 | OverwriteAsNeeded |  0 | HardwareEvents   | 
| 512 |  7 | OverwriteAsNeeded |  0 | Internet Explorer  | 
| 20,480 |  0 | OverwriteAsNeeded |  0 | Key Management Service | 
| 20,480 |  0 | OverwriteAsNeeded | 10,390 | Security    | 
| 20,480 |  0 | OverwriteAsNeeded | 3,561 | System     | 
| 15,360 |  0 | OverwriteAsNeeded |  360 | Windows PowerShell  | 
+--------+--------+-------------------+---------+------------------------+ 

변경 한 번에 하나의 로그, 오류없이이 :

PS> Limit-Eventlog -Logname Application -MaximumSize 200MB -OverflowAction OverwriteAsNeeded 
PS> Limit-Eventlog -Logname HardwareEvents -MaximumSize 200MB -OverflowAction OverwriteAsNeeded 
PS> Limit-Eventlog -Logname "Internet Explorer" -MaximumSize 200MB -OverflowAction OverwriteAsNeeded 
PS> Limit-Eventlog -Logname "Key Management Service" -MaximumSize 200MB -OverflowAction OverwriteAsNeeded 
PS> Limit-Eventlog -Logname Security -MaximumSize 200MB -OverflowAction OverwriteAsNeeded 
PS> Limit-Eventlog -Logname System -MaximumSize 200MB -OverflowAction OverwriteAsNeeded 
PS> Limit-Eventlog -Logname "Windows Powershell" -MaximumSize 200MB -OverflowAction OverwriteAsNeeded 
PS> Get-Eventlog -List 

+---------+--------+-------------------+---------+------------------------+ 
| Max(K) | Retain | OverflowAction | Entries |   Log   | 
+---------+--------+-------------------+---------+------------------------+ 
| 204,800 |  0 | OverwriteAsNeeded | 2,599 | Application   | 
| 204,800 |  0 | OverwriteAsNeeded |  0 | HardwareEvents   | 
| 204,800 |  0 | OverwriteAsNeeded |  0 | Internet Explorer  | 
| 204,800 |  0 | OverwriteAsNeeded |  0 | Key Management Service | 
| 204,800 |  0 | OverwriteAsNeeded | 10,395 | Security    | 
| 204,800 |  0 | OverwriteAsNeeded | 3,561 | System     | 
| 204,800 |  0 | OverwriteAsNeeded |  362 | Windows PowerShell  | 
+---------+--------+-------------------+---------+------------------------+ 

나는 로그 이름을 harcoding 않도록하고 싶습니다. Get-Help Limit-EventLog -example을 통해 알 수 있듯이 ForEach의 경우 더 좋은 방법이 있습니다. 그러나 이렇게하면 Limit-Eventlog을 첫 번째 로그에만 적용하고 나머지는 실패합니다. 참고 오류가 발생한 곳을 쉽게 알 수 있도록 값을 약간 변경했습니다 (200MB에서 100MB).

$Logs = Get-Eventlog -List | Foreach {$_.log} 
Limit-Eventlog -Logname $Logs -MaximumSize 100MB -OverflowAction OverwriteAsNeeded 
Get-Eventlog -List 

+---------+--------+-------------------+---------+------------------------+ 
| Max(K) | Retain | OverflowAction | Entries |   Log   | 
+---------+--------+-------------------+---------+------------------------+ 
| 102,400 |  0 | OverwriteAsNeeded | 2,606 | Application   | 
| 204,800 |  0 | OverwriteAsNeeded |  0 | HardwareEvents   | 
| 204,800 |  0 | OverwriteAsNeeded |  0 | Internet Explorer  | 
| 204,800 |  0 | OverwriteAsNeeded |  0 | Key Management Service | 
| 204,800 |  0 | OverwriteAsNeeded | 10,399 | Security    | 
| 204,800 |  0 | OverwriteAsNeeded | 3,563 | System     | 
| 204,800 |  0 | OverwriteAsNeeded |  369 | Windows PowerShell  | 
+---------+--------+-------------------+---------+------------------------+ 

과 6 오류 :이 두 가지 방법으로 예상대로 모두 작업을 시도했습니다

Limit-Eventlog : The value supplied for MaximumSize parameter has to be in the range of 64 KB to 4GB with an increment of 64 KB. Please enter a proper 
value and then retry. 
At line:2 char:5 
+  Limit-Eventlog -Logname $Logs -MaximumSize 100MB -OverflowAction ... 
+  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
    + CategoryInfo   : InvalidData: (:) [Limit-EventLog], Exception 
    + FullyQualifiedErrorId : ValueOutofRange,Microsoft.PowerShell.Commands.LimitEventLogCommand 

Limit-Eventlog : The value supplied for MaximumSize parameter has to be in the range of 64 KB to 4GB with an increment of 64 KB. Please enter a proper 
value and then retry. 
At line:2 char:5 
+  Limit-Eventlog -Logname $Logs -MaximumSize 100MB -OverflowAction ... 
+  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
    + CategoryInfo   : InvalidData: (:) [Limit-EventLog], Exception 
    + FullyQualifiedErrorId : ValueOutofRange,Microsoft.PowerShell.Commands.LimitEventLogCommand 

Limit-Eventlog : The value supplied for MaximumSize parameter has to be in the range of 64 KB to 4GB with an increment of 64 KB. Please enter a proper 
value and then retry. 
At line:2 char:5 
+  Limit-Eventlog -Logname $Logs -MaximumSize 100MB -OverflowAction ... 
+  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
    + CategoryInfo   : InvalidData: (:) [Limit-EventLog], Exception 
    + FullyQualifiedErrorId : ValueOutofRange,Microsoft.PowerShell.Commands.LimitEventLogCommand 

Limit-Eventlog : The value supplied for MaximumSize parameter has to be in the range of 64 KB to 4GB with an increment of 64 KB. Please enter a proper 
value and then retry. 
At line:2 char:5 
+  Limit-Eventlog -Logname $Logs -MaximumSize 100MB -OverflowAction ... 
+  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
    + CategoryInfo   : InvalidData: (:) [Limit-EventLog], Exception 
    + FullyQualifiedErrorId : ValueOutofRange,Microsoft.PowerShell.Commands.LimitEventLogCommand 

Limit-Eventlog : The value supplied for MaximumSize parameter has to be in the range of 64 KB to 4GB with an increment of 64 KB. Please enter a proper 
value and then retry. 
At line:2 char:5 
+  Limit-Eventlog -Logname $Logs -MaximumSize 100MB -OverflowAction ... 
+  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
    + CategoryInfo   : InvalidData: (:) [Limit-EventLog], Exception 
    + FullyQualifiedErrorId : ValueOutofRange,Microsoft.PowerShell.Commands.LimitEventLogCommand 

Limit-Eventlog : The value supplied for MaximumSize parameter has to be in the range of 64 KB to 4GB with an increment of 64 KB. Please enter a proper 
value and then retry. 
At line:2 char:5 
+  Limit-Eventlog -Logname $Logs -MaximumSize 100MB -OverflowAction ... 
+  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
    + CategoryInfo   : InvalidData: (:) [Limit-EventLog], Exception 
    + FullyQualifiedErrorId : ValueOutofRange,Microsoft.PowerShell.Commands.LimitEventLogCommand 

Answer 1

는 ... 둘은 서로 다른 구문을 사용하여, 같은 일을하고 있습니다.

Limit-Eventlog에 로그 이름의 배열을 전달 :

$Logs = Get-Eventlog -List | select -ExpandProperty Log 
Limit-Eventlog -Logname $Logs -MaximumSize 0.5Gb -OverflowAction OverwriteAsNeeded -WhatIf 

그리고 Limit-Eventlog에 개별적으로 각각의 로그 이름을 전달하는 foreach를 사용 : 테스트하지 않을 경우

$Logs = Get-Eventlog -List | select -ExpandProperty Log 
Foreach ($Log in $Logs) { 
    Limit-Eventlog -Logname $Log -MaximumSize 0.5Gb -OverflowAction OverwriteAsNeeded -WhatIf 
} 

당신은 -WhatIf을 삭제해야합니다.