پایش کارایی و رخدادها با Get-Counter، logman و Get-WinEvent

$c = '\Processor(_Total)\% Processor Time',
     '\Memory\Available MBytes',
     '\PhysicalDisk(_Total)\Avg. Disk sec/Transfer',
     '\PhysicalDisk(_Total)\Current Disk Queue Length',
     '\Network Interface(*)\Bytes Total/sec'
Get-Counter -Counter $c -SampleInterval 5 -MaxSamples 6

logman create counter SahorBaseline -si 00:01:00 -f bincirc -max 512 `
  -o C:\PerfLogs\SahorBaseline `
  -c '\Processor(_Total)\% Processor Time' '\Memory\Available MBytes' `
     '\PhysicalDisk(*)\Avg. Disk sec/Transfer' '\Network Interface(*)\Bytes Total/sec' `
     '\LogicalDisk(*)\% Free Space'
logman start SahorBaseline
logman query SahorBaseline

relog C:\PerfLogs\SahorBaseline_000001.blg -f csv -o C:\PerfLogs\baseline.csv

Get-WinEvent -FilterHashtable @{ LogName = 'System','Application'; Level = 1,2; StartTime = (Get-Date).AddDays(-1) } |
  Group-Object ProviderName | Sort-Object Count -Descending | Select-Object Count, Name -First 10

# Failed logons (4625) in the last hour
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4625; StartTime = (Get-Date).AddHours(-1) } |
  ForEach-Object { $_.Properties[19].Value } | Group-Object | Sort-Object Count -Descending

# Unexpected shutdowns (6008)
Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 6008 } -MaxEvents 5

Get-Volume | Where-Object { $_.DriveLetter -and $_.Size -gt 0 -and ($_.SizeRemaining / $_.Size) -lt 0.10 } |
  ForEach-Object { Write-EventLog -LogName Application -Source 'SahorMonitor' -EventId 900 -EntryType Warning `
    -Message ("Drive {0}: only {1:N1} GB free" -f $_.DriveLetter, ($_.SizeRemaining / 1GB)) }