Get Rid of Get-EventLog

by Sep 21, 2020

The Get-EventLog cmdlet provides easy access to event log entries in the primary Windows event logs, however it neither can access the many application level event logs, nor is it available at all in PowerShell 7.

If you ever plan to run your code in PowerShell 7, you should start getting used to its successor: Get-WinEvent. This cmdlet is powerful and supports many parameters. Here is an example that comes close to what Get-EventLog did:

Get-WinEvent -FilterHashtable @{Logname = 'System'=2,3} -MaxEvents 10 |
  Select-Object TimeCreated, LevelDisplayName, Id, ProviderName, Message |
  Format-Table

Your query is submitted in the form of a hash table, and you can see how to specify the log name and the number of events you want to get. In contrast to Get-EventLog, you can now specify and retrieve any log, not just the few classic logs. You may want to run Show-EventLog to open the event log viewer and discover the many available application level logs.

The hash table “Level” key defines the type of event log entry you want to see. The lower the number the more severe the entry. “2” represents errors, and “3” represents warnings. As you see, you can combine levels as comma-separated list.

The result looks similar to this:

 
TimeCreated         LevelDisplayName    Id ProviderName                     Message                                           
-----------         ----------------    -- ------------                     -------                                           
04.08.2020 13:03:42 Warning          10016 Microsoft-Windows-DistributedCOM The Anwendungsspezifisch permission settings do...
04.08.2020 13:03:20 Error                1 MTConfig                         An attempt to configure the input mode of a mul...
04.08.2020 13:03:19 Error                1 MTConfig                         An attempt to configure the input mode of a mul...
04.08.2020 12:58:18 Error                1 MTConfig                         An attempt to configure the input mode of a mul...
04.08.2020 11:53:38 Error            10010 Microsoft-Windows-DistributedCOM The server Microsoft.SkypeApp_15.61.100.0_x86__...
04.08.2020 11:23:48 Error            10010 Microsoft-Windows-DistributedCOM The server microsoft.windowscommunicationsapps_...
04.08.2020 11:23:41 Error            10010 Microsoft-Windows-DistributedCOM The server Microsoft.SkypeApp_15.61.100.0_x86__...
04.08.2020 11:23:37 Warning            701 Win32k                           Power Manager has not requested suppression of ...
04.08.2020 11:23:37 Warning            701 Win32k                           Power Manager has not requested suppression of ...
04.08.2020 11:23:37 Error            10317 Microsoft-Windows-NDIS           Miniport Microsoft Wi-Fi Direct Virtual Adapter... 
 


Twitter This Tip! ReTweet this Tip!