Powershell：過濾事件日誌

Question

我編寫了一個小腳本，用於在過去10天內從應用程序中檢索事件日誌，但收到錯誤消息。任何想法爲什麼錯誤出現？

Where-Object : Cannot bind parameter 'FilterScript'. Cannot convert value "False" to type "System.Management.Automation.ScriptBlock". Error: "Invalid cast from 'System.Boolean' to 'System.Management.Automation.ScriptBlock'."

#Sets the application log to query 
$Log ="Application" 
$FilterHashTable = @{LogName=$Log} 

#stores the computer name 
$ComputerName = $env:COMPUTERNAME 

#sets the date 10 days ago 
$DeleteDate = Get-Date 
$DeleteDate = $DeleteDate.AddDays(-10) 
Write-Verbose $DeleteDate 

#retrieve WMIevent and logs the information 
$Winevent = Get-WinEvent -ComputerName $ComputerName -FilterHashTable $FilterHashTable -ErrorAction SilentlyContinue 

# Filter on time 
$Winevent | where-object ($_.timecreated -gt $DeleteDate) 

Answer 1

Where-Object需要一個腳本塊參數 - 使用大括號{...}沒有括號(...)來包含過濾邏輯。

當前PS正在檢查您的條件並返回一個布爾值，而不是將其應用爲過濾器。