Tired of waiting for the Event Viewer? Try Get-EventLog

I’m not a programmer and I have never wanted to be one.  I grudgingly began learning PowerShell because it was the way of the future for Windows Systems Administration (Server Core, anyone?)  From the first time I executed the Get-EventLog command, I was hooked on PowerShell.  The Event Viewer in Windows is slow, I mean really slow, so when I executed the Get-EventLog command for the first time, I was amazed by how fast it ran.  When I explored the options for filtering and exporting the results of Get-EventLog, I realized how powerful this command is.

The basic syntax for Get-EventLog is:

Get-EventLog -LogName <logname>

You can find out which logs you have by using Get-EventLog -List (System, Security, PowerShell, etc.) 

Using the -Newest <number> option, you can limit the output to a specific number of entries.  You can also limit the time frame by using -Before <date> and -After <date>.

Get-EventLog -LogName Security -newest 100

Get-EventLog -LogName system -EntryType error -After '1/17/2020 08:00:00' -Before '1/17/2020 17:00:00'

Options for filtering include -EntryType (Error, Information, etc.), -UserName, and -Message (to search for text in the message).  You can also look for the source of a message (such as Outlook) with the -Source option.

Get-EventLog -LogName Security -EntryType FailureAudit -Newest 100

As with most PowerShell commands, you can use the -ComputerName option to view event logs on other Windows systems.

Get-EventLog -LogName System -ComputerName Server01, Server02, Server03

Finally, one of the best things about the Get-EventLog command is that you can pipe the results to different types of files.  ConvertTo-Csv is useful since Excel is one of my favorite tools.  You can also output the results to Json (ConvertTo-Json), XML (ConvertTo-XML), or HTML (ConvertTo-HTML).

Get-EventLog -LogName System | Select-Object -Property timegenerated, username, message | Export-Csv <path>

For more details, see the Microsoft help for Get-EventLog: 

https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

Create your website with WordPress.com
Get started
<span>%d</span> bloggers like this: