按月将Windows日志导出至CSV文件

# 这个月的第一天

#..........................................到这里之前是取当年第一天

#(Get-Date 0).AddYears((Get-Date).Year - 1).AddMonths((Get-Date).Month - 2)

# 这个月的最后一天

#......................................................................到这里之前是次年第一天

#(Get-Date 0).AddYears((Get-Date).Year - 1).AddMonths((Get-Date).Month - 1).AddDays(-1)



$lognames = "Application","Security","System"

$lastmonthfirstday = (Get-Date 0).AddYears((Get-Date).Year - 1).AddMonths((Get-Date).Month - 2)

$lastmonthlastday = (Get-Date 0).AddYears((Get-Date).Year - 1).AddMonths((Get-Date).Month - 1).AddDays(-1)

foreach($logname in $lognames) {

    Get-EventLog -ComputerName $env:COMPUTERNAME -LogName $logname -After $lastmonthfirstday -Before $lastmonthlastday | Export-Csv -Path ("C:\EventLog\" + $lastmonthfirstday.Year + "_" + $lastmonthfirstday.Month + "_" + $env:COMPUTERNAME + "_" + $logname + ".CSV")

}