Retrieving Error Messages From Your Event Logs

by Nov 18, 2009

Event logs record all kinds of stuff. To find the important things, use Get-EventLog and query for the events you are seeking. In PowerShell v.2, Get-Eventlog has a lot of new parameters, such as -computername. With it, you can retrieve events from remote systems, and -computername even accepts more than one computer name.

The next example retrieves the last five error events from all computers listed in a file. Make sure the file exists when you run the example, and of course make sure you have proper access rights to the computers.

Get-EventLog -Newest 5 -LogName System -EntryType Error `
-ComputerName (Get-Content z:\pcnames.txt) |
ft eventid, message, mach*

Twitter This Tip! ReTweet this Tip!