PowerShell Scripts, Tips, Expert Advices, Forums, and Resources

image rotation

Welcome to PowerShell.com, the educational and community site for Windows PowerShell People. Get a quick overview.

Latest Scripts

04-06-2014 - Organize Pictures by Date
04-03-2014 - BlueCat/Proteus API functions
04-03-2014 - Function to build WSDL DLL

As a Powershell.com member you will have access to:

  • Daily PowerShell tips written by Microsoft MVPs and other leading Windows PowerShell experts
  • Free Windows PowerShell advice and training provided by Microsoft MVPs and other leading Windows PowerShell experts
  • Access to leading Windows PowerShell blogs
  • A free ebook, Mastering PowerShell, written by Microsoft MVP Dr. Tobias Weltner
PowerTip of the Day

Getting Events From All Event Logs

Recently, a reader asked how to retrieve all events from all event logs from a local or remote system, and optionally save them to file.

Here is a potential solution:

# calculate start time (one hour before now)
$Start = (Get-Date) - (New-Timespan -Hours 1)
$Computername = $env:COMPUTERNAME 
 
# Getting all event logs
Get-EventLog -AsString -ComputerName $Computername |
  ForEach-Object {
    # write status info
    Write-Progress -Activity "Checking Eventlogs on \\$ComputerName" -Status $_

    # get event entries and add the name of the log this came from
    Get-EventLog -LogName $_ -EntryType Error, Warning -After $Start -ComputerName $ComputerName -ErrorAction SilentlyContinue |
      Add-Member NoteProperty EventLog $_ -PassThru 
       
  } |
  # sort descending
  Sort-Object -Property TimeGenerated -Descending |
  # select the properties for the report
  Select-Object EventLog, TimeGenerated, EntryType, Source, Message | 
  # output into grid view window
  Out-GridView -Title "All Errors & Warnings from \\$Computername" 

At the top of this script, you can set the remote system you want to query, and the number of hours you want to go back.

Next, the script gets all log files available on that machine, and then uses a loop to get the errors and warnings from each log within the timeframe. To be able to know which event came from which log file, it also tags the events with a new property called "EventLog", using Add-Member.

The result is a report with all error and warning events within the last hour, shown in a grid view window. Replace "Out-GridView" with "Out-File" or "Export-Csv" to write the information to disk.

Note that remote access requires Administrator privileges. Remote access might require additional security settings. Note also that you will receive red error messages if you run this code as a non-Administrator (because some logs like "Security" require special access privileges).

Twitter This Tip! ReTweet this Tip!

Copyright 2012 PowerShell.com. All rights reserved.