powershell 通过rtx安全日志获取用户的ip地址对应

版权声明：本文为博主原创文章，未经博主允许不得转载。 https://blog.csdn.net/shrekz/article/details/19082891



$text="[2014-02-11 07:35:11] Uin=1069, UserName=XXX, Addr=192.168.1.53:49193, Action=login, Mode=local, Result=0(success)
[2014-02-11 07:47:56] Uin=1016, UserName=XXX, Addr=192.168.1.5:1110, Action=login, Mode=local, Result=0(success)
[2014-02-11 08:16:36] Uin=1078, UserName=XXX, Addr=192.168.1.140:1050, Action=login, Mode=local, Result=0(success)
[2014-02-11 08:34:53] Uin=1084, UserName=XXX, Addr=192.168.1.26:49169, Action=login, Mode=local, Result=0(success)
[2014-02-11 08:35:06] Uin=1084, UserName=XXX, Addr=192.168.1.26:49169, Action=logout, Mode=local
[2014-02-11 08:35:26] Uin=1085, UserName=XXX, Addr=192.168.1.26:49179, Action=login, Mode=local, Result=0(success)
[2014-02-11 08:37:42] Uin=1034, UserName=XXX, Addr=192.168.1.86:1140, Action=login, Mode=local, Result=0(success)
"
$t1=@()
$text.split("`n")|
%{$null=$_ -match '.+ UserName=(?<name>.+), Addr=(?<ip>.+):.+'
$t1+=("$($Matches.name) $($Matches.ip)")
}
$t1|select -Unique|sort