PowerShell Logo Small

Get-WinEvent



This is the built-in help made by Microsoft for the command 'Get-WinEvent', in PowerShell version 5 - as retrieved from Windows version 'Microsoft Windows Server 2012 R2 Standard' PowerShell help files on 2016-06-23.

For PowerShell version 3 and up, where you have Update-Help, this command was run just before creating the web pages from the help files.

SYNOPSIS

Gets events from event logs and event tracing log files on local and remote computers.

SYNTAX


Get-WinEvent [[-LogName] <String[]>] [-ComputerName <String>] [-Credential <PSCredential>] [-FilterXPath <String>] [-Force] [-MaxEvents <Int64>] [-Oldest]
[<CommonParameters>]
Get-WinEvent [-ListProvider] <String[]> [-ComputerName <String>] [-Credential <PSCredential>] [<CommonParameters>]
Get-WinEvent [-ProviderName] <String[]> [-ComputerName <String>] [-Credential <PSCredential>] [-FilterXPath <String>] [-Force] [-MaxEvents <Int64>] [-Oldest]
[<CommonParameters>]
Get-WinEvent [-ListLog] <String[]> [-ComputerName <String>] [-Credential <PSCredential>] [-Force] [<CommonParameters>]
Get-WinEvent [-FilterHashtable] <Hashtable[]> [-ComputerName <String>] [-Credential <PSCredential>] [-Force] [-MaxEvents <Int64>] [-Oldest] [<CommonParameters>]
Get-WinEvent [-FilterXml] <XmlDocument> [-ComputerName <String>] [-Credential <PSCredential>] [-MaxEvents <Int64>] [-Oldest] [<CommonParameters>]
Get-WinEvent [-Path] <String[]> [-Credential <PSCredential>] [-FilterXPath <String>] [-MaxEvents <Int64>] [-Oldest] [<CommonParameters>]



Search powershellhelp.space

DESCRIPTION


The Get-WinEvent cmdlet gets events from event logs, including classic logs, such as the System and Application logs, and the event logs that are generated by the Windows
Event Log technology introduced in Windows Vista. It also gets events in log files generated by Event Tracing for Windows (ETW).


Without parameters, a Get-WinEvent command gets all the events from all the event logs on the computer. To interrupt the command, press CTRL + C.


Get-WinEvent also lists event logs and event log providers. You can get events from selected logs or from logs generated by selected event providers. And, you can combine
events from multiple sources in a single command. Get-WinEvent allows you to filter events by using XPath queries, structured XML queries, and simplified hash-table queries.



<

RELATED LINKS

Online Version: http://go.microsoft.com/fwlink/p/?linkid=289626
Get-Counter
Get-EventLog
about_EventLogs

REMARKS

<

Examples


-------------------------- EXAMPLE 1 --------------------------

PS C:\>Get-WinEvent -ListLog *



This command gets all the logs on the local computer.

Logs are listed in the order that Get-WinEvent gets them. Classic logs are usually retrieved first, followed by the new Windows Eventing logs.

Because there are typically more than a hundred event logs, this parameter requires a log name or name pattern. To get all the logs, use *.




-------------------------- EXAMPLE 2 --------------------------

PS C:\>Get-WinEvent -ListLog Setup | Format-List -Property *

FileSize : 69632
IsLogFull : False
LastAccessTime : 2/14/2008 12:55:12 AM
LastWriteTime : 7/9/2008 3:12:05 AM
OldestRecordNumber : 1
RecordCount : 3
LogName : Setup
LogType : Operational
LogIsolation : Application
IsEnabled : True
IsClassicLog : False
SecurityDescriptor : O:BAG:SYD:(A;;0xf0007;;;SY)(A;
(A;;0x1;;;S-1-5-32-573)
LogFilePath : %SystemRoot%\System32\Winevt\L
MaximumSizeInBytes : 1052672
LogMode : Circular
OwningProviderName : Microsoft-Windows-Eventlog
ProviderNames : {Microsoft-Windows-WUSA, Micro
ProviderLevel :
ProviderKeywords :
ProviderBufferSize : 64
ProviderMinimumNumberOfBuffers : 0
ProviderMaximumNumberOfBuffers : 64
ProviderLatency : 1000
ProviderControlGuid :



These commands get an object that represents the classic System log on the local computer. The object includes useful information about the log, including its size, event
log provider, file path, and whether it is enabled.




-------------------------- EXAMPLE 3 --------------------------

PS C:\>Get-WinEvent -ListLog * -ComputerName Server01 |Where-Object {$_.RecordCount}



This command gets only event logs on the Server01 computer that contain events. Many logs might be empty.

The command uses the RecordCount property of the EventLogConfiguration object that Get-WinEvent returns when you use the ListLog parameter.




-------------------------- EXAMPLE 4 --------------------------

PS C:\>$s = "Server01", "Server02", "Server03"
PS C:\>Foreach ($Server in $S) {$Server; Get-WinEvent -ListLog "Windows PowerShell" -Computername $Server}



The commands in this example get objects that represent the Windows PowerShell event logs on the Server01, Server02, and Server03 computers. This command uses the Foreach
keyword because the ComputerName parameter takes only one value.

The first command saves the names of the computers in the $s variable.

The second command uses a Foreach statement. For each of the computers in the $s variable, it performs the command in the script block (within the braces). First, the
command prints the name of the computer. Then, it runs a Get-WinEvent command to get an object that represents the Windows PowerShell log.




-------------------------- EXAMPLE 5 --------------------------

PS C:\>Get-WinEvent -ListProvider *



This command gets the event log providers on the local computer and the logs to which they write, if any.




-------------------------- EXAMPLE 6 --------------------------

PS C:\>(Get-WinEvent -ListLog Application).ProviderNames



This command gets all of the providers that write to the Application log on the local computer.




-------------------------- EXAMPLE 7 --------------------------

PS C:\>Get-WinEvent -ListProvider *policy*



This command gets the event log providers whose names include the word "policy."




-------------------------- EXAMPLE 8 --------------------------

PS C:\>(Get-WinEvent -ListProvider Microsoft-Windows-GroupPolicy).Events | Format-Table ID, Description -AutoSize



This command lists the event IDs that the Microsoft-Windows-GroupPolicy event provider generates along with the event description.

It uses the Events property of the object that Get-WinEvent returns when you use the ListProvider parameter, and it uses the ID and Description properties of the object in
the Events property.




-------------------------- EXAMPLE 9 --------------------------

The first command uses the Get-WinEvent cmdlet to get all of the events in the Windows PowerShell event log. Then, it saves them in the $Events variable. The log name is
enclosed in quotation marks because it contains a space.
PS C:\>$Events = Get-WinEvent -LogName "Windows PowerShell"

The second command uses the Count property of object collections to find the number of entries in the event log.
PS C:\>$Events.Count
195

The third command displays the incidence of each event in the log, with the most frequent events first. In this example, event ID 600 is the most frequent event.
PS C:\>$Events | Group-Object -Property Id -NoElement | Sort-Object -Property Count -Descending

Count Name
----- ----
147 600
22 400
21 601
3 403
2 103

The fourth command groups the items by the value of their LevelDisplayName property to show how many Error, Warning, and Information events are in the log.
PS C:\>$Events | Group-Object -Property LevelDisplayName -NoElement

Count Name
----- ----
2 Warning
193 Information



This example shows how to use the properties of the event objects that Get-WinEvent returns to learn about the events in an event log.




-------------------------- EXAMPLE 10 --------------------------

PS C:\>Get-WinEvent -LogName *disk*, Microsoft-Windows-Kernel-WHEA



This command gets the error events whose names include "disk" from all of the event logs on the computer and from the Microsoft-Windows-Kernel-WHEA event log.




-------------------------- EXAMPLE 11 --------------------------

PS C:\>Get-WinEvent -Path 'c:\ps-test\Windows PowerShell.evtx'



This command gets events from a copy of the Windows PowerShell event log file in a test directory. The path is enclosed in quotation marks because the log name includes a
space.




-------------------------- EXAMPLE 12 --------------------------

The first command gets the 100 oldest events in the log. It uses the Get-WinEvent cmdlet to get events from the Tracelog.etl file. It uses the MaxEvents parameter to limit
the retrieval to 100 events. Because the events are listed in the order in which they are written to the log (oldest first), the Oldest parameter is required.
PS C:\>Get-WinEvent -Path 'C:\Tracing\TraceLog.etl' -MaxEvents 100 -Oldest

The second command gets the 100 newest events in the log. It uses the Get-WinEvent cmdlet to get all the events from the Tracing.etl file. It pipes the events to the
Sort-Object cmdlet, which sorts them in descending order by the value of the TimeCreated property. Then, it pipes the sorted events to the Select-Object cmdlet to select the
newest 100 events.
PS C:\>Get-WinEvent -Path 'C:\Tracing\TraceLog.etl' -Oldest | Sort-Object -Property TimeCreated -Descending | Select-Object -First 100



These commands get the first 100 events from an Event Tracing for Windows (ETW) event trace log file.




-------------------------- EXAMPLE 13 --------------------------

PS C:\>Get-WinEvent -Path "C:\Tracing\TraceLog.etl", "c:\Logs\Windows PowerShell.evtx" -Oldest | Where-Object {$_.ID -eq "103"}



This example shows how to get the events from an event trace log file (.etl) and from a copy of the Windows PowerShell log file (.evtx) that was saved to a test directory.

You can combine multiple file types in a single command. Because the files contain the same type of .NET Framework object (an EventLogRecord object), you can use the same
properties to filter them.

The command requires the Oldest parameter because it is reading from an .etl file, but the Oldest parameter applies to both of the files.




-------------------------- EXAMPLE 14 --------------------------

PS C:\># Use the Where-Object cmdlet

PS C:\>$yesterday = (Get-Date) - (New-TimeSpan -Day 1)
PS C:\>Get-WinEvent -LogName "Windows PowerShell" | Where-Object {$_.TimeCreated -ge $yesterday}

# Uses FilterHashTable

PS C:\>$yesterday = (Get-Date) - (New-TimeSpan -Day 1)
PS C:\>Get-WinEvent -FilterHashTable @{LogName='Windows PowerShell'; Level=3; StartTime=$yesterday}

# Use FilterXML

PS C:\>Get-WinEvent -FilterXML "<QueryList><Query><Select Path='Windows PowerShell'>*[System[Level=3 and TimeCreated[timediff(@SystemTime)&lt;=
86400000]]]</Select></Query></QueryList>"

# Use FilterXPath

PS C:\>Get-WinEvent -LogName "Windows Powershell" -FilterXPath "*[System[Level=3 and TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]"



This example shows different filtering methods for selecting events from an event log. All of these commands get events that occurred in the last 24 hours from the Windows
PowerShell event log.

The filter methods are more efficient than using the Where-Object cmdlet because the filters are applied while the objects are being retrieved, rather than retrieving all
the objects and then filtering them.

Because dates are difficult to formulate in the XML and XPath formats, to create the XML content for the date, the Filter Current Log feature of Event Viewer is used. For
more information about this feature, see Event Viewer Help.




-------------------------- EXAMPLE 15 --------------------------

PS C:\>$date = (Get-Date).AddDays(-2)
PS C:\>$events = Get-WinEvent -FilterHashTable @{ LogName = "Microsoft-Windows-Diagnostics-Performance/Operational"; StartTime = $date; ID = 100 }



This example uses a filter hash table to get events from the performance log.

The first command uses the Get-Date cmdlet and the AddDays method to get a date that is two days before the current date. It saves the date in the $date variable.

The second command uses the Get-WinEvent cmdlet with the FilterHashTable parameter. The keys in the hash table define a filter that selects events from the performance log
that occurred within the last two days and that have event ID 100.

The LogName key specifies the event log, the StartTime key specifies the date, and the ID key specifies the event ID.




-------------------------- EXAMPLE 16 --------------------------

PS C:\>$StartTime = (Get-Date).AddDays(-7)
PS C:\>$IE_Error = Get-WinEvent -FilterHashtable @{Logname="Application"; ProviderName="Application Error"; Data="iexplore.exe"; StartTime=$StartTime}



This example uses a filter hash table to find Internet Explorer application errors that occurred within the last week.

The first command gets the date that is seven days before the current date and stores it in the $StartTime variable.

The second command uses the Get-WinEvent cmdlet with the FilterHashTable parameter. The keys in the hash table define a filter that selects events from the Application log
that were written by the Application Error provider and include the phrase "iexplore.exe".

The LogName key specifies the event log. The ProviderName key specifies the event provider, the StartTime key specifies the starting date of the events, and the Data key
specifies the text in the event message.