1. 程式人生 > >關於Windows server 2008資訊收集的批處理指令碼

關於Windows server 2008資訊收集的批處理指令碼

rem //////////////////////////////////////////////////////
rem  日期:2014.5.26
rem  作者:[email protected]
rem  功能:
rem     1.當前登入伺服器賬號:
rem 	2.當前伺服器與時間伺服器的時間誤差:
rem 	3.系統啟動時間:
rem 	4.系統打的補丁數量:
rem 	5.系統未正常啟動的自啟動服務:
rem 	6.error event log(24小時內)
rem 	7.所有磁碟的空餘空間百分比
rem 
rem //////////////////////////////////////////////////////


@echo off
setlocal ENABLEDELAYEDEXPANSION
set "infoName=INFO_%computername%_%date:~0,4%%date:~5,2%%date:~8,2%"
set "infoName=%infoName%.txt"


rem //////////////////////////////////////////////////////
>%infoName%  echo 1.當前登入伺服器賬號:
>>%infoName% echo =====
>>%infoName% whoami
>>%infoName% echo.
>>%infoName% echo.


rem //////////////////////////////////////////////////////
>>%infoName% echo 2.當前伺服器與時間伺服器的時間誤差:
>>%infoName% echo =====
for /f "tokens=1,2* delims=:" %%i in ('ipconfig ^| find "IPv4"') do (
	set ip=%%j
	set ip=!ip: =!
	>>%infoName% W32TM.EXE /STRIPCHART /COMPUTER:!ip! /SAMPLES:1
)
>>%infoName% echo.
>>%infoName% echo.


rem //////////////////////////////////////////////////////
>>%infoName% echo 3.系統啟動時間:
>>%infoName% echo =====
set /a n=0
for /f %%i in ('WMIC PATH Win32_PerfFormattedData_PerfOS_System GET SystemUpTime') do (
	set /a n+=1
	if !n! equ 2 (set /a d=%%i)
)
set /a d=%d%/8640
if %d% GEQ 10 (
	set d=%d:~0,-1%.%d:~-1%
) else (
	set d=0.%d%
)
>>%infoName% echo %d%D
>>%infoName% echo.
>>%infoName% echo.


rem //////////////////////////////////////////////////////
>>%infoName% echo 4.系統打的補丁數量:
>>%infoName% echo =====
WMIC PATH Win32_QuickFixEngineering GET HotFixID | FIND /C /I "KB" >>%infoName% 
>>%infoName% echo.
>>%infoName% echo.


rem //////////////////////////////////////////////////////
>>%infoName% echo 5.系統未正常啟動的自啟動服務:
>>%infoName% echo =====
setlocal DISABLEDELAYEDEXPANSION

if exist ~tmptmp.log (del /f/q ~tmptmp.log)
>~tmptmp.log WMIC PATH Win32_Service WHERE (StartMode='Auto' AND State!='Running' AND Name!='SysmonLog') GET Name
>>%infoName% type ~tmptmp.log
if exist ~tmptmp.log (del /f/q ~tmptmp.log)

setlocal ENABLEDELAYEDEXPANSION
>>%infoName% echo.
>>%infoName% echo.


rem //////////////////////////////////////////////////////
>>%infoName% echo 6.error event log(24小時內)
>>%infoName% echo =====
set a=%time:~0,2%
set year=%date:~0,4%
set /a month=%date:~5,2%
set /a day=%date:~8,2%-1

if %day% equ 0 (
	set /a month=%month%-1
	if !month! equ 0 (
		set /a year=%year%-1
		set /a month=12
		set /a day=30
	) else (
		if !month! equ 2 (
			set /a day=28
		) else (
			set /a day=30
		)
	)
)
if %a% LSS 10 set a=0%a:~1,1%
if %month% LSS 10 set month=0%month%
if %day% LSS 10 set day=0%day%

set t=%year%%month%%day%%a%%time:~3,2%%time:~6,2%

if exist ~tmptmp.log (del /f/q ~tmptmp.log)
>~tmptmp.log WMIC NTEVENT where 'type="錯誤" and TimeGenerated^>"%t%.000000-000"' get EventCode, LogFile, SourceName, TimeGenerated, Message, type
>>%infoName% type ~tmptmp.log
if exist ~tmptmp.log (del /f/q ~tmptmp.log)
>>%infoName% echo.
>>%infoName% echo.


rem //////////////////////////////////////////////////////
>>%infoName% echo 7.所有磁碟的空餘空間百分比
>>%infoName% echo =====
for %%i in (c d e f g h i j k l m n o p q r s t u v w x y z) do (
	if exist %%i: (
		set /a n=0
		for /f "tokens=1,2" %%x in ('wmic LogicalDisk where ^"Caption^=^'%%i^:^'^" get FreeSpace^,Size') do (
			set /a n+=1
			if !n! equ 2 (
				if %%x neq 0 (
					set  a=%%x
					set  b=%%y
					set /a per=!a:~0,-4!/!b:~0,-6!
					>>%infoName% echo %%i: !per:~0,2!%%
				)
			)
		)
	)
)
>>%infoName% echo.
>>%infoName% echo.