Finding Registered Event Sources

by Apr 23, 2014

Each Windows log file has a list of registered event sources. To find out which event sources are registered to which event log, you can directly query the Windows Registry.

This will dump all registered sources for the "System" event log:

$LogName = 'System'
$path = "HKLM:\System\CurrentControlSet\services\eventlog\$LogName"
Get-ChildItem -Path $path -Name 

Twitter This Tip! ReTweet this Tip!