# make sure the watcher emits events $FileSystemWatcher.EnableRaisingEvents = $true
# define the code that should execute when a file change is detected $Action = { $details = $event.SourceEventArgs $Name = $details.Name $FullPath = $details.FullPath $OldFullPath = $details.OldFullPath $OldName = $details.OldName $ChangeType = $details.ChangeType $Timestamp = $event.TimeGenerated $text = "{0} was {1} at {2}"-f$FullPath, $ChangeType, $Timestamp Write-Host"" Write-Host$text-ForegroundColor Green
# you can also execute code based on change type here switch ($ChangeType) { 'Changed' { "CHANGE" } 'Created' { "CREATED"} 'Deleted' { "DELETED" # uncomment the below to mimick a time intensive handler <# Write-Host "Deletion Handler Start" -ForegroundColor Gray Start-Sleep -Seconds 4 Write-Host "Deletion Handler End" -ForegroundColor Gray #> } 'Renamed' { # this executes only when a file was renamed $text = "File {0} was renamed to {1}"-f$OldName, $Name Write-Host$text-ForegroundColor Yellow } default { Write-Host$_-ForegroundColor Red -BackgroundColor White } } }
Write-Host"Monitoring content of $PathToMonitor" explorer $PathToMonitor while ($true) { $Change = $FileSystemWatcher.WaitForChanged('All', 1000) if ($Change.TimedOut -eq$false) { # get information about the changes detected Write-Host"Change detected:" $Change | Out-Default
# uncomment this to see the issue #Start-Sleep -Seconds 5 } else { Write-Host"."-NoNewline } }
这个示例可以正常工作。当您向监控的文件夹增加文件，或者作出改变时，将会监测到改变的类型。您可以容易地得到该信息并采取操作。例如，对于 IT 部门，人们可以向一个投放文件夹投放文件和说明，您的脚本可以自动处理这些文件。
# set the event log name you want to subscribe to # (use Get-EventLog -AsString for a list of available event log names) $Name = 'Application'
# get an instance $Log = [System.Diagnostics.EventLog]$Name
# determine what to do when an event occurs $Action = { # get the original event entry that triggered the event $entry = $event.SourceEventArgs.Entry
# log all events Write-Host"Received from $($entry.Source): $($entry.Message)"
# do something based on a specific event if ($entry.EventId -eq1-and$entry.Source -eq'WinLogon') { Write-Host"Test event was received!"-ForegroundColor Red }
}
# subscribe to its "EntryWritten" event $job = Register-ObjectEvent-InputObject$log-EventName EntryWritten -SourceIdentifier'NewEventHandler'-Action$Action
# now whenever an event is written to the log, $Action is executed # use a loop to keep PowerShell busy. You can abort via CTRL+C
Write-Host"Listening to events"-NoNewline
try { do { Wait-Event-SourceIdentifier NewEventHandler -Timeout1 Write-Host"."-NoNewline
} while ($true) } finally { # this executes when CTRL+C is pressed Unregister-Event-SourceIdentifier NewEventHandler Remove-Job-Name NewEventHandler Write-Host"" Write-Host"Event handler stopped." }
Simply “convert” the event log name into an object of “EventLog” type. The result looks similar to this and provides information about the number of entries and the log file size: 只需要将时间日志名称“转换”为一个 “EventLog“ 类型的对象。结果类似这样，并且提供了条目的数量和日志文件尺寸等信息：
1 2 3 4 5
PS> $systemLogDirect
Max(K) Retain OverflowAction Entries Log ------------------------------------ 20.4800 OverwriteAsNeeded 19.806 System