Get-EventLog

Gets the events in an event log, or a list of the event logs, on the local or remote computers.

Syntax

	Copy Code
Get-EventLog [-AsString] [-ComputerName <string[]>] [-List] [<CommonParameters>] Get-EventLog [-LogName] <string> [[-InstanceId] <Int64[]>] [-After <DateTime>] [-AsBaseObject] [-Before <DateTime>] [-ComputerName <string[]>] [-EntryType <string[]>] [-Index <Int32[]>] [-Message <string>] [-Newest <int>] [-Source <string[]>] [-UserName <string[]>] [<CommonParameters>]

Copy Code

Get-EventLog [-AsString] [-ComputerName <string[]>] [-List] [<CommonParameters>]

Get-EventLog [-LogName] <string> [[-InstanceId] <Int64[]>] [-After <DateTime>] [-AsBaseObject] [-Before <DateTime>] [-ComputerName <string[]>] [-EntryType <string[]>] [-Index <Int32[]>] [-Message <string>] [-Newest <int>] [-Source <string[]>] [-UserName <string[]>] [<CommonParameters>]

Description

The Get-EventLog cmdlet gets events and event logs on the local and remote computers.

Use the parameters of Get-EventLog to search for events by using their property values. Get-EventLog gets only the events that match all of the specified property values.

The cmdlets that contain the EventLog noun (the EventLog cmdlets) work only on classic event logs. To get events from logs that use the Windows Event Log technology in Windows Vista and later versions of Windows, use Get-WinEvent.

Parameters

-After <DateTime>

Gets only the events that occur after the specified date and time. Enter a DateTime object, such as the one returned by the Get-Date cmdlet.

Required?	false
Position?	named
Default Value
Accept Pipeline Input?	false
Accept Wildcard Characters?	false

-AsBaseObject

Returns a standard System.Diagnostics.EventLogEntry object for each event. Without this parameter, Get-EventLog returns an extended PSObject object with additional EventLogName, Source, and InstanceId properties.

To see the effect of this parameter, pipe the events to the Get-Member cmdlet and examine the TypeName value in the result.

Required?	false
Position?	named
Default Value	False
Accept Pipeline Input?	false
Accept Wildcard Characters?	false

-AsString

Returns the output as strings, instead of objects.

Required?	false
Position?	named
Default Value
Accept Pipeline Input?	false
Accept Wildcard Characters?	false

-Before <DateTime>

Gets only the events that occur before the specified date and time. Enter a DateTime object, such as the one returned by the Get-Date cmdlet.

Required?	false
Position?	named
Default Value
Accept Pipeline Input?	false
Accept Wildcard Characters?	false

-ComputerName <string[]>

Specifies a remote computer. The default is the local computer.

Type the NetBIOS name, an Internet Protocol (IP) address, or a fully qualified domain name of a remote computer. To specify the local computer, type the computer name, a dot (.), or "localhost".

This parameter does not rely on Windows PowerShell remoting. You can use the ComputerName parameter of Get-EventLog even if your computer is not configured to run remote commands.

Required?	false
Position?	named
Default Value
Accept Pipeline Input?	false
Accept Wildcard Characters?	false

-EntryType <string[]>

Gets only events with the specified entry type. Valid values are Error, Information, FailureAudit, SuccessAudit, and Warning. The default is all events.

Required?	false
Position?	named
Default Value	All events
Accept Pipeline Input?	false
Accept Wildcard Characters?	false

-Index <Int32[]>

Gets only events with the specified index values.

Required?	false
Position?	named
Default Value	All events
Accept Pipeline Input?	false
Accept Wildcard Characters?	false

-InstanceId <Int64[]>

Gets only events with the specified instance IDs.

Required?	false
Position?	2
Default Value
Accept Pipeline Input?	false
Accept Wildcard Characters?	false

-List

Gets a list of event logs on the computer.

Required?	false
Position?	named
Default Value
Accept Pipeline Input?	false
Accept Wildcard Characters?	false

-LogName <string>

Specifies the event log. Enter the log name (the value of the Log property; not the LogDisplayName) of one event log. Wildcard characters are not permitted. This parameter is required.

Required?	true
Position?	1
Default Value
Accept Pipeline Input?	false
Accept Wildcard Characters?	false

-Message <string>

Gets events that have the specified string in their messages. You can use this property to search for messages that contain certain words or phrases. Wildcards are permitted.

Required?	false
Position?	named
Default Value
Accept Pipeline Input?	false
Accept Wildcard Characters?	true

-Newest <int>

Specifies the maximum number of events retrieved. Get-EventLog gets the specified number of events, beginning with the newest event in the log.

Required?	false
Position?	named
Default Value
Accept Pipeline Input?	false
Accept Wildcard Characters?	false

-Source <string[]>

Gets events that were written to the log by the specified sources. Wildcards are permitted.

Required?	false
Position?	named
Default Value
Accept Pipeline Input?	false
Accept Wildcard Characters?	true

-UserName <string[]>

Gets only the events that are associated with the specified user names. Enter names or name patterns, such as User01, User*, or Domain01\User*. Wildcards are permitted.

Required?	false
Position?	named
Default Value
Accept Pipeline Input?	false
Accept Wildcard Characters?	true

<CommonParameters>

This command supports the common parameters: Verbose, Debug, ErrorAction, ErrorVariable, OutBuffer, OutVariable, WarningAction, and WarningVariable. For more information, see about_CommonParameters.

Inputs and Outputs

The input type is the type of the objects that you can pipe to the cmdlet. The return type is the type of the objects that the cmdlet returns.

Inputs

None.

You cannot pipe input to this cmdlet.

Outputs

System.Diagnostics.EventLogEntry. System.Diagnostics.EventLog. System.String

If the LogName parameter is specified, the output is a collection of EventLogEntry objects (System.Diagnostics.EventLogEntry). If only the List parameter is specified, the output is a collection of EventLog objects (System.Diagnostics.EventLog). If both the List and AsString parameters are specified, the output is a collection of Strings (System.String).

Example 1

	Copy Code
C:\PS>get-eventlog -list Description ----------- This command displays information about the event logs on the computer.

Example 2

	Copy Code
C:\PS>get-eventlog -newest 5 -logname application Description ----------- This command displays the five most recent entries in the Application event log.

Example 3

	Copy Code
C:\PS>$events = get-eventlog -logname system -newest 1000 C:\PS> $events \| group-object -property source -noelement \| sort-object -property count -descending Count Name ----- ---- 75 Service Control Manager 12 Print 6 UmrdpService 2 DnsApi 2 DCOM 1 Dhcp 1 TermDD 1 volsnap Description ----------- This example shows how to find all of the sources that are represented in the 1000 most recent entries in the System event log. The first command gets the 1,000 most recent entries from the System event log and stores them in the $events variable. The second command uses a pipeline operator (\|) to send the events in $events to the Group-Object cmdlet, which groups the entries by the value of the Source property. The command uses a second pipeline operator to send the grouped events to the Sort-Object cmdlet, which sorts them in descending order, so the most frequently appearing source is listed first. Source is just property of event log entries. To see all of the properties of an event log entry, pipe the events to the Get-Member cmdlet.

Copy Code

C:\PS>$events = get-eventlog -logname system -newest 1000

C:\PS> $events | group-object -property source -noelement | sort-object -property count -descending

Count Name
----- ----
   75 Service Control Manager
   12 Print
	6 UmrdpService
	2 DnsApi
	2 DCOM
	1 Dhcp
	1 TermDD
	1 volsnap

Description
-----------
This example shows how to find all of the sources that are represented in the 1000 most recent entries in the System event log.

The first command gets the 1,000 most recent entries from the System event log and stores them in the $events variable. 

The second command uses a pipeline operator (|) to send the events in $events to the Group-Object cmdlet, which groups the entries by the value of the Source property. The command uses a second pipeline operator to send the grouped events to the Sort-Object cmdlet, which sorts them in descending order, so the most frequently appearing source is listed first.

Source is just property of event log entries. To see all of the properties of an event log entry, pipe the events to the Get-Member cmdlet.

Example 4

	Copy Code
C:\PS>get-eventlog -logname System -EntryType Error Description ----------- This command gets only error events from the System event log.

Example 5

	Copy Code
C:\PS>get-eventlog -logname System -instanceID 3221235481 -Source "DCOM" Description ----------- This command gets events from the System log that have an InstanceID of 3221235481 and a Source value of "DCOM."

Copy Code

C:\PS>get-eventlog -logname System -instanceID 3221235481 -Source "DCOM"

Description
-----------
This command gets events from the System log that have an InstanceID of 3221235481 and a Source value of "DCOM."

Example 6

	Copy Code
C:\PS>get-eventlog -logname "Windows PowerShell" -computername localhost, Server01, Server02 Description ----------- This command gets the events from the "Windows PowerShell" event log on three computers, Server01, Server02, and the local computer, known as "localhost".

Copy Code

C:\PS>get-eventlog -logname "Windows PowerShell" -computername localhost, Server01, Server02

Description
-----------
This command gets the events from the "Windows PowerShell" event log on three computers, Server01, Server02, and the local computer, known as "localhost".

Example 7

	Copy Code
C:\PS>get-eventlog -logname "Windows PowerShell" -message "failed" Description ----------- This command gets all the events in the Windows PowerShell event log that have a message value that includes the word "failed".

Copy Code

C:\PS>get-eventlog -logname "Windows PowerShell" -message "*failed*"

Description
-----------
This command gets all the events in the Windows PowerShell event log that have a message value that includes the word "failed".

Example 8

	Copy Code
C:\PS>$a = get-eventlog -log System -newest 1 C:\PS> $a \| format-list -property * EventID : 7036 MachineName : Server01 Data : {} Index : 10238 Category : (0) CategoryNumber : 0 EntryType : Information Message : The description for Event ID Source : Service Control Manager ReplacementStrings : {WinHTTP Web Proxy Auto-Disco InstanceId : 1073748860 TimeGenerated : 4/11/2008 9:56:05 PM TimeWritten : 4/11/2008 9:56:05 PM UserName : Site : Container : Description ----------- This example shows how to display all of the property values of an event. The first command gets the newest event from the System event log and saves it in the $a variable. The second command uses a pipeline operator (\|) to send the event in $a to the Format-List command, which displays all (*) of the event properties.

Copy Code

C:\PS>$a = get-eventlog -log System -newest 1

C:\PS> $a | format-list -property *

EventID			: 7036
MachineName		: Server01
Data			 : {}
Index			: 10238
Category		 : (0)
CategoryNumber	 : 0
EntryType		: Information
Message			: The description for Event ID
Source			 : Service Control Manager
ReplacementStrings : {WinHTTP Web Proxy Auto-Disco
InstanceId		 : 1073748860
TimeGenerated	: 4/11/2008 9:56:05 PM
TimeWritten		: 4/11/2008 9:56:05 PM
UserName		 :
Site			 :
Container		:

Description
-----------
This example shows how to display all of the property values of an event. 

The first command gets the newest event from the System event log and saves it in the $a variable. 

The second command uses a pipeline operator (|) to send the event in $a to the Format-List command, which displays all (*) of the event properties.

Example 9

	Copy Code
C:\PS>get-eventlog -log application -source outlook \| where {$_.eventID -eq 34} Description ----------- This command gets events in the Application event log where the source is Outlook and the event ID is 34. Even though Get-EventLog does not have an EventID parameter, you can use the Where-Object cmdlet to select events based on the value of any event property.

Copy Code

C:\PS>get-eventlog -log application -source outlook | where {$_.eventID -eq 34}

Description
-----------
This command gets events in the Application event log where the source is Outlook and the event ID is 34. Even though Get-EventLog does not have an EventID parameter, you can use the Where-Object cmdlet to select events based on the value of any event property.

Example 10

	Copy Code
C:\PS>get-eventlog -log system -username NT* \| group-object -property username -noelement \| format-table Count, Name -auto Count Name ----- ---- 6031 NT AUTHORITY\SYSTEM 42 NT AUTHORITY\LOCAL SERVICE 4 NT AUTHORITY\NETWORK SERVICE Description ----------- This command returns the events in the system log grouped by the value of their UserName property. The Get-EventLog command uses the UserName parameter to get only events in which the user name begins with "NT*".

Copy Code

C:\PS>get-eventlog -log system -username NT* | group-object -property username -noelement | format-table Count, Name -auto

Count Name
----- ----
 6031 NT AUTHORITY\SYSTEM
   42 NT AUTHORITY\LOCAL SERVICE
	4 NT AUTHORITY\NETWORK SERVICE

Description
-----------
This command returns the events in the system log grouped by the value of  their UserName property. The Get-EventLog command uses the UserName parameter to get only events in which the user name begins with "NT*".

Example 11

	Copy Code
C:\PS>$May31 = get-date 5/31/08 C:\PS> $July1 = get-date 7/01/08 C:\PS> get-eventlog -log "Windows PowerShell" -entrytype Error -after $may31 -before $july1 Description ----------- This command gets all of the errors in the Windows PowerShell event log that occurred in June 2008.

Copy Code

C:\PS>$May31 = get-date 5/31/08

C:\PS> $July1 = get-date 7/01/08

C:\PS> get-eventlog -log "Windows PowerShell" -entrytype Error -after $may31 -before $july1

Description
-----------
This command gets all of the errors in the Windows PowerShell event log that occurred in June 2008.

Syntax

Description

Parameters

-After <DateTime>

-AsBaseObject

-AsString

-Before <DateTime>

-ComputerName <string[]>

-EntryType <string[]>

-Index <Int32[]>

-InstanceId <Int64[]>

-List

-LogName <string>

-Message <string>

-Newest <int>

-Source <string[]>

-UserName <string[]>

<CommonParameters>

Inputs and Outputs

Example 1

Example 2

Example 3

Example 4

Example 5

Example 6

Example 7

Example 8

Example 9

Example 10

Example 11

See Also

Concepts