Get-WinEvent

PS C:\> Get-WinEvent -ListLog  *

PS C:\> Get-WinEvent -ListLog Setup | Format-List -Property *

   FileSize                       : 69632
   IsLogFull                      : False
   LastAccessTime                 : 2/14/2008 12:55:12 AM
   LastWriteTime                  : 7/9/2008 3:12:05 AM
   OldestRecordNumber             : 1
   RecordCount                    : 3
   LogName                        : Setup
   LogType                        : Operational
   LogIsolation                   : Application
   IsEnabled                      : True
   IsClassicLog                   : False
   SecurityDescriptor             : O:BAG:SYD:(A;;0xf0007;;;SY)(A;
   (A;;0x1;;;S-1-5-32-573)
   LogFilePath                    : %SystemRoot%\System32\Winevt\L
   MaximumSizeInBytes             : 1052672
   LogMode                        : Circular
   OwningProviderName             : Microsoft-Windows-Eventlog
   ProviderNames                  : {Microsoft-Windows-WUSA, Micro
   ProviderLevel                  :
   ProviderKeywords               :
   ProviderBufferSize             : 64
   ProviderMinimumNumberOfBuffers : 0
   ProviderMaximumNumberOfBuffers : 64
   ProviderLatency                : 1000
   ProviderControlGuid            :

PS C:\> Get-WinEvent -ListLog * -ComputerName Server01 |Where-Object {$_.RecordCount}

PS C:\> $s = "Server01", "Server02", "Server03"
PS C:\> Foreach ($Server in $S) {$Server; Get-WinEvent -ListLog "Windows PowerShell" -Computername $Server}

PS C:\> Get-WinEvent -ListProvider *

PS C:\> (Get-WinEvent -ListLog Application).ProviderNames

PS C:\> Get-WinEvent -ListProvider *policy*

PS C:\> (Get-WinEvent -ListProvider Microsoft-Windows-GroupPolicy).Events | Format-Table ID, Description -AutoSize

1. Then, it saves them in the $Events variable:

   PS C:\> $Events = Get-WinEvent -LogName "Windows PowerShell"
   

   The log name is enclosed in quotation marks because it contains a space.

2. The second command uses the Count property of object collections to find the number of entries in the event log:

   PS C:\> $Events.Count
   195
   

3. The third command displays the incidence of each event in the log, with the most frequent events first:

   PS C:\> $Events | Group-Object -Property Id -NoElement | Sort-Object -Property Count -Descending
   
      Count Name
      ----- ----
      147 600
      22 400
      21 601
      3 403
      2 103

   In this example, event ID 600 is the most frequent event.

4. The fourth command groups the items by the value of their LevelDisplayName property to show how many Error, Warning, and Information events are in the log:

   PS C:\> $Events | Group-Object -Property LevelDisplayName -NoElement
   
      Count Name
      ----- ----
      2 Warning
      193 Information

   This example shows how to use the properties of the event objects that Get-WinEvent returns to learn about the events in an event log.

PS C:\> Get-WinEvent -LogName *disk*, Microsoft-Windows-Kernel-WHEA

PS C:\> Get-WinEvent -Path 'c:\ps-test\Windows PowerShell.evtx'

1. It uses the Get-WinEvent cmdlet to get events from the Tracelog.etl file:

   PS C:\> Get-WinEvent -Path 'C:\Tracing\TraceLog.etl' -MaxEvents 100 -Oldest
   

   It uses the MaxEvents parameter to limit the retrieval to 100 events. Because the events are listed in the order in which they are written to the log (oldest first), the Oldest parameter is required.

2. The second command gets the 100 newest events in the log:

   PS C:\> Get-WinEvent -Path 'C:\Tracing\TraceLog.etl' -Oldest | Sort-Object -Property TimeCreated -Descending | Select-Object -First 100
   

   It uses the Get-WinEvent cmdlet to get all the events from the Tracing.etl file. It pipes the events to the Sort-Object cmdlet, which sorts them in descending order by the value of the TimeCreated property. Then, it pipes the sorted events to the Select-Object cmdlet to select the newest 100 events.These commands get the first 100 events from an Event Tracing for Windows (ETW) event trace log file.

PS C:\> Get-WinEvent -Path "C:\Tracing\TraceLog.etl", "c:\Logs\Windows PowerShell.evtx" -Oldest | Where-Object {$_.ID -eq "103"}

PS C:\> # Use the Where-Object cmdlet


PS C:\> $yesterday = (Get-Date) - (New-TimeSpan -Day 1)
PS C:\> Get-WinEvent -LogName "Windows PowerShell" | Where-Object {$_.TimeCreated -ge $yesterday}

   # Uses FilterHashTable

PS C:\> $yesterday = (Get-Date) - (New-TimeSpan -Day 1)
PS C:\> Get-WinEvent -FilterHashTable @{LogName='Windows PowerShell'; Level=3; StartTime=$yesterday}

   # Use FilterXML

PS C:\> Get-WinEvent -FilterXML "<QueryList><Query><Select Path='Windows PowerShell'>*[System[Level=3 and TimeCreated[timediff(@SystemTime)&lt;= 86400000]]]</Select></Query></QueryList>"

   # Use FilterXPath

PS C:\> Get-WinEvent -LogName "Windows Powershell" -FilterXPath "*[System[Level=3 and TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]"

PS C:\> $date = (Get-Date).AddDays(-2)
PS C:\> $events = Get-WinEvent -FilterHashTable @{ LogName = "Microsoft-Windows-Diagnostics-Performance/Operational"; StartTime = $date; ID = 100 }

PS C:\> $StartTime = (Get-Date).AddDays(-7)
PS C:\> $IE_Error = Get-WinEvent -FilterHashtable @{Logname="Application"; ProviderName="Application Error"; Data="iexplore.exe"; StartTime=$StartTime}