Accessing Event Logs Directly

by Dec 12, 2018

With Get-EventLog, you can easily dump the content for any given event log, however if you’d like to directly access a given event log, you can only use the -List parameter to dump them all, then pick the one you are after:

$SystemLog = Get-EventLog -List | Where-Object { $_.Log -eq 'System' }

A more direct way uses casting, like this:

$systemLogDirect = [System.Diagnostics.EventLog]'System'

Simply “convert” the event log name into an object of “EventLog” type. The result looks similar to this and provides information about the number of entries and the log file size:

PS> $systemLogDirect

  Max(K) Retain OverflowAction        Entries Log                                                       
  ------ ------ --------------        ------- ---                                                       
  20.480      0 OverwriteAsNeeded      19.806 System   

Twitter This Tip! ReTweet this Tip!