{"id":109,"date":"2013-06-03T12:36:18","date_gmt":"2013-06-03T08:36:18","guid":{"rendered":"http:\/\/use-powershell.com\/?p=109"},"modified":"2013-09-18T14:54:32","modified_gmt":"2013-09-18T10:54:32","slug":"using-get-winevent-to-look-at-windows-event-logs","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/powershell\/using-get-winevent-to-look-at-windows-event-logs\/","title":{"rendered":"Using Get-WinEvent to look at Windows event logs"},"content":{"rendered":"

Playing around with Get-WinEvent<\/code> today. I find it very useful, especially when dealing with remote computers (as I have to at work). Launching Event Viewer, connecting to a remote computer (or even local computer), and then sifting through logs (or creating filters to sift) seems very cumbersome when I can acheive the same results much faster via PowerShell. <\/p>\n

As you might have seen the Event Viewer has various logs. Using Get-WinEvent<\/code> you can select which logs to focus on. To get a list of available logs do the following:<\/p>\n

\r\nGet-WinEvent -ListLog *\r\n<\/pre>\n
Probably better to filter through format-table<\/code> for neater output:<\/p>\n
\r\nGet-WinEvent -ListLog * | ft LogName -AutoSize\r\n<\/pre>\n
To view details of a specific log, replace *<\/code> with the name (and pipe output to format-list<\/code> to view all the details):<\/p>\n
\r\nGet-WinEvent -ListLog $logname | fl *\r\n<\/pre>\n
To view all events in a log do the following:<\/p>\n
\r\nGet-WinEvent -LogName System\r\n<\/pre>\n
There’s a lot of output, so good to restrict the number of entries:<\/p>\n
\r\nGet-WinEvent -LogName System -MaxEvents 50\r\n<\/pre>\n
Strangely there’s no easy way to restrict the entries starting at a certain time. There is, but no easy switchy way. Instead you have to do the following:<\/p>\n
\r\nGet-WinEvent -FilterHashTable @{LogName=\"System\";StartTime=(get-date).AddHours(-2)}\r\n<\/pre>\n
We use the -FilterHashTable<\/code> switch here. This takes a hash table containing the log name as well as other parameters to filter on (you can start time, end time, provider name, ID, etc, and can combine multiple parameters). In the example above I want all events from the “System” log for the last 2 hours – so I use the get-date<\/code> cmdlet, use it’s method AddHours()<\/code> and set the number of hours to be added as -2. <\/p>\n
In the next example I filter all events from the “System” log with event ID 7036 starting from now yesterday up to an hour ago. <\/p>\n
\r\nGet-WinEvent -FilterHashTable @{LogName=\"System\"; StartTime=(get-date).AddDays(-1); EndTime=(get-date).AddHours(-1); ID=7036}\r\n<\/pre>\n
To change the displayed order of events from newest-first to oldest-first use the -Oldest<\/code> switch. <\/p>\n
\r\nGet-WinEvent -Oldest\r\n<\/pre>\n
Beats piping the output to a sort<\/code> cmdlet to reverse-sort!<\/p>\n
Similar to how you can list the lognames you can list providers too: <\/p>\n
\r\nGet-WinEvent -ListProvider *\r\n<\/pre>\n
This gives a list of the providers (the applications or sources that log events) and the logs to which they send events. The list can be huge, so a good idea is to pipe the output through where-object<\/code> to filter by the providers you are interested in:<\/p>\n
\r\nGet-WinEvent -ListProvider * | ?{ $_.Name -match \"PowerShell\" }\r\n<\/pre>\n
Note:<\/strong> The case doesn’t really matter above (“PowerShell”) because the -match<\/code> operator is case in-sensitive by default. Use -cmatch<\/code> if you care about case. <\/p>\n
Back to the -FormatHashTable<\/code> switch: this one takes a “ProviderName” key too containing the name of the provider you wish to filter on. The name can contain wildcards if you want to search multiple providers. For instance, the example below searches the “Application” log for all entries by the Citrix providers (there are many hence the wildcard) logged in the past three hours:<\/p>\n
\r\nGet-WinEvent -FilterHashtable @{LogName=\"Application\"; ProviderName=\"Citrix*\"; StartTime=(get-date).AddHours(-3)}\r\n<\/pre>\n
Note:<\/strong> In the example above, I can omit the logname. The hashtable requires either the log name or the provider name (or the path to a log). If you don’t care about the log name or provider name, mention one of these but leave the value as a wildcard. Like thus:<\/p>\n
\r\nGet-WinEvent -FilterHashtable @{LogName=\"*\"; StartTime=(get-date).AddHours(-3)}\r\n<\/pre>\n
The above example gets all logs from the past 3 hours. <\/p>\n
The default output of Get-WinEvent<\/code> includes a lot of fields. Best to use format-table<\/code> or select-object<\/code> to only show what you want. In the example below I use select-object<\/code> to select just the Message, ID, and TimeCreated properties. Further I pipe the output to a CSV file (doing that just to show how easy it is to quickly pull some remote logs into a CSV file): <\/p>\n
\r\nGet-WinEvent -ComputerName $computer -FilterHashtable @{LogName=\"*\"; StartTime=(get-date).AddHours(-3)} | \r\n  select Message,Id,TimeCreated | \r\n  Export-Csv c:pathtocsvfile\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
Playing around with Get-WinEvent today. I find it very useful, especially when dealing with remote computers (as I have to at work). Launching Event Viewer, connecting to a remote computer (or even local computer), and then sifting through logs (or creating filters to sift) seems very cumbersome when I can acheive the same results much … Continue reading Using Get-WinEvent to look at Windows event logs<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[2],"tags":[14,34],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/109"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=109"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/109\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}