Recently, a reader asked how to retrieve all events from all event logs from a local or remote system, and optionally save them to file.
Here is a potential solution:
# calculate start time (one hour before now) $Start = (Get-Date) - (New-Timespan -Hours 1) $Computername = $env:COMPUTERNAME # Getting all event logs Get-EventLog -AsString -ComputerName $Computername | ForEach-Object { # write status info Write-Progress -Activity "Checking Eventlogs on \\$ComputerName" -Status $_ # get event entries and add the name of the log this came from Get-EventLog -LogName $_ -EntryType Error, Warning -After $Start -ComputerName $ComputerName -ErrorAction SilentlyContinue | Add-Member NoteProperty EventLog $_ -PassThru } | # sort descending Sort-Object -Property TimeGenerated -Descending | # select the properties for the report Select-Object EventLog, TimeGenerated, EntryType, Source, Message | # output into grid view window Out-GridView -Title "All Errors & Warnings from \\$Computername"
At the top of this script, you can set the remote system you want to query, and the number of hours you want to go back.
Next, the script gets all log files available on that machine, and then uses a loop to get the errors and warnings from each log within the timeframe. To be able to know which event came from which log file, it also tags the events with a new property called "EventLog", using Add-Member.
The result is a report with all error and warning events within the last hour, shown in a grid view window. Replace "Out-GridView" with "Out-File" or "Export-Csv" to write the information to disk.
Note that remote access requires Administrator privileges. Remote access might require additional security settings. Note also that you will receive red error messages if you run this code as a non-Administrator (because some logs like "Security" require special access privileges).
