PowerShell 명령어의 기초 — 가장 먼저 익힐 조작과 안전한 사용법

찾는다 → 본다 → 좁힌다 → 정렬한다 → 출력한다 → 필요하면 변경한다

Get-ChildItem

Get-ChildItem -File |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
  Sort-Object LastWriteTime -Descending |
  Select-Object Name, Length, LastWriteTime

$PSVersionTable

#Requires -Version 7.0

Get-Process
Get-Service
Get-ChildItem
Copy-Item
Remove-Item
Export-Csv

Get-Command dir

# 읽기는 편하지만, 스크립트에서는 피하고 싶다
ls *.log

# 의도가 명확하다
Get-ChildItem -Filter *.log

# Process라는 명사를 가진 명령어를 찾는다
Get-Command -Noun Process

# Service 관련 명령어를 찾는다
Get-Command *Service*

# CSV 관련 명령어를 찾는다
Get-Command *Csv*

Get-Command *Item*
Get-Command *Content*
Get-Command *Json*

Get-Help Get-ChildItem
Get-Help Get-ChildItem -Examples
Get-Help Get-ChildItem -Full
Get-Help Get-ChildItem -Online

Get-Help Where-Object -Examples

Update-Help

Get-Process | Get-Member
Get-Service | Get-Member
Get-ChildItem | Get-Member

Get-Service | Select-Object Name, Status

Get-ChildItem -File | Select-Object Name, Length, LastWriteTime

Get-Process | Sort-Object CPU -Descending | Select-Object -First 10

프로세스 목록을 가져온다
  → CPU 사용량 기준으로 내림차순 정렬한다
  → 상위 10개만 표시한다

# 정지된 서비스만 표시
Get-Service | Where-Object { $_.Status -eq "Stopped" }

# 100MB를 초과하는 파일만 표시
Get-ChildItem -File |
  Where-Object { $_.Length -gt 100MB }

# 이름에 backup을 포함하는 파일만 표시
Get-ChildItem -File |
  Where-Object { $_.Name -like "*backup*" }

Where-Object { $_.Length -gt 100MB }

Get-Service | Where-Object Status -EQ "Stopped"

Get-Service | Where-Object { $_.Status -eq "Stopped" }

# 메모리 사용량이 큰 순서
Get-Process |
  Sort-Object WorkingSet -Descending |
  Select-Object -First 10 Name, Id, WorkingSet

# 수정 일시가 최신인 순서
Get-ChildItem -File |
  Sort-Object LastWriteTime -Descending |
  Select-Object -First 20 Name, LastWriteTime

Get-Process |
  Select-Object Name, Id, CPU, WorkingSet

Get-Process | Select-Object -First 5
Get-Process | Select-Object -Last 5

Get-Service |
  Select-Object Name, DisplayName, Status, StartType |
  Export-Csv .\services.csv -NoTypeInformation -Encoding UTF8

Format-Table
Format-List
Format-Wide

# 피해야 함: CSV에 표시용 정보가 섞인다
Get-Process |
  Format-Table Name, CPU |
  Export-Csv .\process.csv -NoTypeInformation

# 올바른 방법: 먼저 속성을 선택하고 CSV로 출력한다
Get-Process |
  Select-Object Name, CPU |
  Export-Csv .\process.csv -NoTypeInformation -Encoding UTF8

Get-Location

Set-Location C:\Work

Set-Location "C:\Work Files\Reports"

Get-ChildItem
Get-ChildItem -File
Get-ChildItem -Directory
Get-ChildItem -Recurse

Get-ChildItem -Filter *.log

Get-ChildItem C:\Logs -Filter *.log -Recurse

# 폴더 생성
New-Item -ItemType Directory -Path .\archive

# 빈 파일 생성
New-Item -ItemType File -Path .\memo.txt

if (-not (Test-Path .\archive)) {
  New-Item -ItemType Directory -Path .\archive
}

Copy-Item .\report.xlsx .\backup\report.xlsx

Copy-Item .\data .\backup\data -Recurse

Copy-Item .\data .\backup\data -Recurse -WhatIf

Move-Item .\old.log .\archive\old.log

Get-ChildItem .\logs -Filter *.log |
  Where-Object { $_.LastWriteTime -lt (Get-Date).AddDays(-30) } |
  Move-Item -Destination .\archive -WhatIf

Get-ChildItem .\logs -Filter *.log |
  Where-Object { $_.LastWriteTime -lt (Get-Date).AddDays(-30) } |
  Move-Item -Destination .\archive

Remove-Item .\old.log -WhatIf

Remove-Item .\old.log

# 먼저 대상을 확인
Get-ChildItem C:\Logs -Filter *.tmp -Recurse |
  Select-Object FullName, Length, LastWriteTime

# 다음으로 삭제 예정을 확인
Get-ChildItem C:\Logs -Filter *.tmp -Recurse |
  Remove-Item -WhatIf

# 마지막으로 실행
Get-ChildItem C:\Logs -Filter *.tmp -Recurse |
  Remove-Item

Get-Content .\app.log

Get-Content .\app.log -Tail 50

Get-Content .\app.log -Tail 20 -Wait

Select-String -Path .\app.log -Pattern "ERROR"

Select-String -Path .\logs\*.log -Pattern "ERROR", "WARN"

Select-String -Path .\logs\*.log -Pattern "ERROR" |
  Select-Object Path, LineNumber, Line |
  Export-Csv .\error-lines.csv -NoTypeInformation -Encoding UTF8

"hello" | Set-Content .\memo.txt -Encoding UTF8
"next line" | Add-Content .\memo.txt -Encoding UTF8

Get-Process |
  Select-Object Name, Id, CPU |
  Export-Csv .\process.csv -NoTypeInformation -Encoding UTF8

$users = Import-Csv .\users.csv
$users

$users | Select-Object Name, Department

$users |
  Where-Object { $_.Department -eq "Sales" }

$users |
  Where-Object { $_.Enabled -eq "true" }

$users |
  Where-Object { $_.Department -eq "Sales" } |
  Export-Csv .\sales-users.csv -NoTypeInformation -Encoding UTF8

# 피해야 함
$users | Format-Table | Export-Csv .\out.csv -NoTypeInformation

# 올바른 방법
$users | Select-Object Name, Department, Enabled | Export-Csv .\out.csv -NoTypeInformation -Encoding UTF8

$data = Get-Content .\settings.json -Raw | ConvertFrom-Json
$data

[pscustomobject]@{
  Name = "BatchJob"
  Enabled = $true
  Retry = 3
} | ConvertTo-Json

$config | ConvertTo-Json -Depth 10 | Set-Content .\settings.json -Encoding UTF8

Get-Process

Get-Process |
  Sort-Object WorkingSet -Descending |
  Select-Object -First 10 Name, Id, WorkingSet

Get-Process -Name notepad

Stop-Process -Name notepad -WhatIf

Stop-Process -Name notepad

Get-Service

Get-Service |
  Where-Object { $_.Status -eq "Stopped" }

Get-Service -Name "Spooler"

Get-Service -Name "Spooler"
Restart-Service -Name "Spooler" -WhatIf

Get-WinEvent -LogName System -MaxEvents 100 |
  Where-Object { $_.LevelDisplayName -eq "Error" } |
  Select-Object TimeCreated, ProviderName, Id, Message

Get-WinEvent -LogName Application -MaxEvents 50 |
  Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message

$start = (Get-Date).AddHours(-24)

Get-WinEvent -FilterHashtable @{
  LogName = "System"
  StartTime = $start
} |
  Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message

Get-WinEvent -LogName System -MaxEvents 500 |
  Where-Object { $_.LevelDisplayName -in @("Error", "Warning") } |
  Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message |
  Export-Csv .\system-events.csv -NoTypeInformation -Encoding UTF8

$path = "C:\Logs"
Get-ChildItem $path

$today = Get-Date
$limit = (Get-Date).AddDays(-30)

$extensions = @("*.log", "*.txt", "*.csv")

foreach ($ext in $extensions) {
  Get-ChildItem C:\Work -Filter $ext
}

$params = @{
  Path = "C:\Logs"
  Filter = "*.log"
  Recurse = $true
}

Get-ChildItem @params

[pscustomobject]@{
  ComputerName = $env:COMPUTERNAME
  UserName     = $env:USERNAME
  CheckedAt    = Get-Date
}

Get-ChildItem C:\Logs -Filter *.log |
  ForEach-Object {
    [pscustomobject]@{
      Name          = $_.Name
      FullName      = $_.FullName
      SizeMB        = [math]::Round($_.Length / 1MB, 2)
      LastWriteTime = $_.LastWriteTime
    }
  } |
  Export-Csv .\log-files.csv -NoTypeInformation -Encoding UTF8

# Find-OldLogs.ps1
param(
  [string]$Path = "C:\Logs",
  [int]$Days = 30,
  [string]$OutputPath = ".\old-logs.csv"
)

$limit = (Get-Date).AddDays(-$Days)

Get-ChildItem -Path $Path -Filter *.log -File -Recurse |
  Where-Object { $_.LastWriteTime -lt $limit } |
  Select-Object FullName, Length, LastWriteTime |
  Export-Csv -Path $OutputPath -NoTypeInformation -Encoding UTF8

Write-Host "Exported: $OutputPath"

.\Find-OldLogs.ps1 -Path C:\Logs -Days 60 -OutputPath .\old-logs.csv

Get-ExecutionPolicy
Get-ExecutionPolicy -List

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

try {
  Copy-Item .\source.txt .\backup\source.txt -ErrorAction Stop
  Write-Host "Copy succeeded"
}
catch {
  Write-Error "Copy failed: $($_.Exception.Message)"
}

$results = foreach ($file in Get-ChildItem .\input -File) {
  try {
    Copy-Item $file.FullName .\backup -ErrorAction Stop

    [pscustomobject]@{
      FileName = $file.Name
      Status   = "OK"
      Message  = ""
    }
  }
  catch {
    [pscustomobject]@{
      FileName = $file.Name
      Status   = "NG"
      Message  = $_.Exception.Message
    }
  }
}

$results | Export-Csv .\copy-result.csv -NoTypeInformation -Encoding UTF8

1. Get 계열로 대상을 본다
2. Where-Object로 좁힌다
3. Select-Object로 대상 목록을 확인한다
4. Export-Csv로 기록한다
5. -WhatIf로 변경 예정을 확인한다
6. 실제로 실행한다

Get-ChildItem C:\Temp -Filter *.tmp -File -Recurse

$limit = (Get-Date).AddDays(-30)

Get-ChildItem C:\Temp -Filter *.tmp -File -Recurse |
  Where-Object { $_.LastWriteTime -lt $limit }

$targets = Get-ChildItem C:\Temp -Filter *.tmp -File -Recurse |
  Where-Object { $_.LastWriteTime -lt $limit }

$targets |
  Select-Object FullName, Length, LastWriteTime

$targets |
  Select-Object FullName, Length, LastWriteTime |
  Export-Csv .\delete-targets.csv -NoTypeInformation -Encoding UTF8

$targets | Remove-Item -WhatIf

$targets | Remove-Item

Get-ChildItem C:\App\Logs -Filter *.log -File -Recurse

$since = (Get-Date).AddDays(-7)

Get-ChildItem C:\App\Logs -Filter *.log -File -Recurse |
  Where-Object { $_.LastWriteTime -ge $since }

$since = (Get-Date).AddDays(-7)

Get-ChildItem C:\App\Logs -Filter *.log -File -Recurse |
  Where-Object { $_.LastWriteTime -ge $since } |
  Select-String -Pattern "ERROR"

$since = (Get-Date).AddDays(-7)

Get-ChildItem C:\App\Logs -Filter *.log -File -Recurse |
  Where-Object { $_.LastWriteTime -ge $since } |
  Select-String -Pattern "ERROR" |
  Select-Object Path, LineNumber, Line |
  Export-Csv .\error-report.csv -NoTypeInformation -Encoding UTF8

# Export-ErrorReport.ps1
param(
  [string]$LogPath = "C:\App\Logs",
  [int]$Days = 7,
  [string]$Pattern = "ERROR",
  [string]$OutputPath = ".\error-report.csv"
)

$since = (Get-Date).AddDays(-$Days)

Get-ChildItem $LogPath -Filter *.log -File -Recurse |
  Where-Object { $_.LastWriteTime -ge $since } |
  Select-String -Pattern $Pattern |
  Select-Object Path, LineNumber, Line |
  Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8

Write-Host "Exported: $OutputPath"

.\Export-ErrorReport.ps1 -LogPath C:\App\Logs -Days 14 -Pattern "ERROR|FATAL" -OutputPath .\errors.csv

$source = "C:\Work\Reports"
$dest = "C:\Work\Archive"
$limit = (Get-Date).AddDays(-90)

$targets = Get-ChildItem $source -Filter *.xlsx -File |
  Where-Object { $_.LastWriteTime -lt $limit }

$targets | Select-Object FullName, Length, LastWriteTime

if (-not (Test-Path $dest)) {
  New-Item -ItemType Directory -Path $dest
}

$targets |
  Select-Object FullName, Length, LastWriteTime |
  Export-Csv .\archive-targets.csv -NoTypeInformation -Encoding UTF8

$targets | Move-Item -Destination $dest -WhatIf

$targets | Move-Item -Destination $dest

Get-Command
Get-Help
Get-Member
Get-Location
Set-Location
Get-ChildItem
Get-Content
Select-String

Where-Object
Sort-Object
Select-Object
ForEach-Object
Format-Table
Format-List

Import-Csv
Export-Csv
ConvertFrom-Json
ConvertTo-Json
Set-Content
Add-Content
Out-File

New-Item
Copy-Item
Move-Item
Rename-Item
Remove-Item
Start-Service
Stop-Service
Restart-Service
Stop-Process

# 본다
Get-ChildItem .\logs -Filter *.tmp

# 삭제 예정을 본다
Get-ChildItem .\logs -Filter *.tmp | Remove-Item -WhatIf

# 실행한다
Get-ChildItem .\logs -Filter *.tmp | Remove-Item

Get-Command로 찾는다
Get-Help로 사용법을 본다
Get-Member로 속성을 확인한다
Get-* 로 대상을 본다
Where-Object로 좁힌다
Select-Object로 열을 정리한다
Export-Csv로 증거를 남긴다
-WhatIf로 변경 예정을 확인한다
마지막으로 실행한다

본다 → 좁힌다 → 기록한다 → 예행한다 → 실행한다