Powershell

processi

Get-Process

tail

 Get-Content alert_orcl.log -Tail 200

grep

Select-String -Path "*.sql" -Pattern "xxx" 

uniq

Select-Object -Unique -ExpandProperty Line

sort

Sort-Object

nmap

Test-NetConnection -ComputerName <indirizzo_ip_o_hostname> -Port <numero_porta>

tnc 192.168.1.1 -p 80

Ricerca Eventi

sql server

Per guardare chi o cosa ha fermato i servizi in una fascia oraria:

$startTime = Get-Date "2026-09-22 01:15:00"
$endTime   = Get-Date "2026-09-22 01:40:00"

Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$startTime; EndTime=$endTime} | 
Where-Object {$_.Message -like "*SQL*" -or $_.ProviderName -eq "Service Control Manager"} | 
Select-Object TimeCreated, ProviderName, Id, Message

Per guardare gli eventi di start/stop di sql server:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'} -MaxEvents 100 | 
Where-Object {$_.Message -like "*SQL*"} | 
Select-Object TimeCreated, Id, Message

VSS e Snapshot

$startTime = Get-Date "2026-09-22 01:15:00"
$endTime   = Get-Date "2026-09-22 01:40:00"
Get-WinEvent -FilterHashtable @{
   LogName = 'Application'
   StartTime = $StartTime
   EndTime   = $EndTime
   ProviderName = 'MSSQLSERVER', 'VSS', 'SQLWRITER'
   ID = 18264, 18265, 8224
} -MaxEvents 50 | Select-Object TimeCreated, Id, ProviderName, Message | Format-Table -AutoSize

Get-WinEvent -FilterHashtable @{
   LogName   = 'Application'
   StartTime = $StartTime
   EndTime   = $EndTime
   # Puoi aggiungere anche i provider/ID VSS e SQL:
   ProviderName = 'MSSQLSERVER', 'VSS'
   ID = 18264, 18265, 8224
} | Select-Object TimeCreated, Id, ProviderName, Message | Format-Table -AutoSize