Get eventlog data, list the event logs.

      Get-EventLog [-logName] string [-newest int]

      Get-EventLog [-list] [-asString]

   -logName string
       Name of the log file from which to get log events.

       Return a list of the log files available.

       Send the output as a string, instead of object(s).

       Gets the newest 'n' event log entries, where 
       'n' represents a numerical value for the newest 
       entries in the eventlog.

       -Verbose, -Debug, -ErrorAction, -ErrorVariable, -WarningAction, -WarningVariable,
       -OutBuffer -OutVariable.

Get-EventLog only works against the 'classic' event logs - it is compatible with Windows XP and 2003.

To query the new style event logs first introduced in Windows Vista use Get-WinEvent.

Event logs often contain tens of thousands of event log entries, so consider using -Newest parameter to limit the number of entries returned.


Display the 50 most recent entries in the Application event log:

PS C:\> get-eventlog -newest 50 -logname application

Get the 100 recent entries from the System event log and store in $MyEvents.
Then pipeline the results to group-object to group them by event id.

PS C:\> $events = get-eventlog -logname system -newest 100
PS C:\> $events | group-object eventid

Write a new message to the Application eventlog:

PS C:\> $log = Get-EventLog -List | Where-Object { $_.Log -eq "Application" }
PS C:\> $log.Source = "Test"
PS C:\> $log.WriteEntry("Test message")

PS C:\> Get-EventLog Application -Newest 1 | Select Message

"The Statesman who yields to war fever must realize that once the signal is given, he is no longer the master of policy but the slave of unforeseeable and uncontrollable events" ~ Sir Winston Spencer Churchill


Get-WinEvent - Get event log data (Vista+)
Get-Event - Get events in the event queue
Show-EventLog - Display an event log

Copyright © 1999-2017
Some rights reserved