{"componentChunkName":"component---src-templates-articles-index-jsx","path":"/articles/powershell-manage-windows-event-log/","result":{"data":{"props":{"adsense":false,"adsenseMobile":null,"byLine":"","canonical":"https://staging.business.com/articles/powershell-manage-windows-event-log/","content":"\n

The Windows event log is one of those ubiquitous products that nearly every Windows system administrator has experience with. When there is a break, unexpected change or security breach, the Windows event log is usually the first place to look.

\r\n

When inspecting the event log via the event viewer, it's hard to narrow down what you're looking for if your search spans multiple event logs or if you need to search for events across many computers at once. In that case, PowerShell can come to the rescue.

\r\n

PowerShell has two cmdlets to read the event log: Get-EventLog and Get-WinEvent. Each cmdlet performs the same task in a slightly different way. Let's perform some common tasks and see how their syntax compares.

\r\n

Listing event logs

\r\n

First, we can enumerate event logs. Using Get-EventLog, we can use the List parameter, while Get-WinEvent uses the ListLog parameter.

\r\n

\"\"

\r\n

I cut off the output from both commands, but when you run both, you'll immediately notice that Get-WinEvent returns a lot more logs. This is because it's capable of querying the logs that show up under Applications and Services in the event viewer, while Get-EventLog cannot.

\r\n

Querying individual event logs

\r\n

Once we know the logs available to query, we can then narrow down the query to a particular event log using either cmdlet.

\r\n

\"\"

\r\n

This will output each event in the event log you provide to the LogName parameter on either cmdlet in chronological order. But what if you need to find specific events? In that case, you'll need to filter.

\r\n

There are many different ways to filter events using both cmdlets, although more so with Get-WinEvent. For example, perhaps I want to see all events in my Application event log that happened a week ago or earlier. With Get-EventLog, after defining the date seven days ago, I can use the After parameter.

\r\n

\"\"

\r\n

We can do something similar using Get-WinEvent, although this time, we have to use one of its filter parameters. In this instance, I'll use the FilterHashTable parameter.

\r\n

\"\"

\r\n

Maybe we'd like to find only those events that match a specific ID. Both cmdlets can do that too.

\r\n

\"\"

\r\n

Get-WinEvent > Get-EventLog

\r\n

There's a lot we can do with both cmdlets, but Get-WinEvent takes the cake in sheer functionality. Excluding the fact it can query many more types of event logs than Get-EventLog, its filtering ability can't be beat.

\r\n

In the cases above, we were using the FilterHashTable parameter, but this is just one example. Get-WinEvent also supports filtering events by their native XML format using FilterXML. For example, if we would like to find all events with a provider name of \"disk\" in the system event log with an event ID of 1, we could define the XML as below and pass that value to the FilterXML parameter.

\r\n

\"\"

\r\n

Is defining all of that XML not your thing? No problem. We can use XPath too.

\r\n

\"\"

\r\n

Get-WinEvent provides many options to filter events, making it far superior to the Get-EventLog cmdlet in terms of functionality.

\r\n

Summary

\r\n

We just scratched the surface as to what these two cmdlets can do. In a nutshell, if you need to perform simple event log queries, Get-EventLog is probably going to be easier to work with. If you find yourself needing to create complex queries across local and remote computers, Get-WinEvent is a much better choice.

\n","docType":"article","guid":"articles_8a4cd6bb6d712079e04a09a36823b094","lastModified":"2019-04-08T19:00:00.000Z","published":"2019-04-08T19:00:00.000Z","structuredData":null,"subtitle":"PowerShell has two cmdlets that can help your Windows administrator read the event log.","template":"legacy","title":"Using PowerShell to Manage the Windows Event Log","type":"article","author":{"avatar":null,"bio":"Adam Bertram is a 20-year veteran of IT and experienced online business professional. He's an entrepreneur, IT influencer, Microsoft MVP, blogger, trainer and content marketing writer for multiple technology companies. Adam is also the founder of the popular IT career development platform TechSnips. Catch up on Adam's articles at adamtheautomator.com, connect on LinkedIn, or follow him on Twitter at @adbertram or the TechSnips Twitter account at @techsnips_io.","name":"Adam Bertram","image":null,"slug":null,"social":{"facebook":"","linkedin":"https://www.linkedin.com/in/adambertram/","twitter":"https://twitter.com/adbertram","website":"https://www.adamtheautomator.com/"},"status":"enabled","title":null,"type":"Contributing Writer","user":{"imagePath":"https://staging.business.com/images/undefined","profile":{"company":"eGain Communications","jobTitle":"Product Management Analyst","website":""}}},"breadcrumbs":null,"channels":{"primary":{"name":"Technology","slug":"technology"},"sub":{"name":"Technology Solutions","slug":"technology-solutions"}},"meta":{"robots":"index, follow","description":"Find out how to use these two cmdlets to read the Windows event log on your PC.","title":"Managing the Windows Event Log With PowerShell - business.com"},"parsedContent":{"toc":[{"id":"listing-event-logs","title":"Listing event logs"},{"id":"querying-individual-event-logs","title":"Querying individual event logs"},{"id":"get-winevent-greater-get-eventlog","title":"Get-WinEvent > Get-EventLog"},{"id":"summary","title":"Summary"}],"json":[{"component":"p","children":["The Windows event log is one of those ubiquitous products that nearly every Windows system administrator has experience with. When there is a break, unexpected change or security breach, the Windows event log is usually the first place to look."]},{"component":"p","children":["When inspecting the event log via the event viewer, it's hard to narrow down what you're looking for if your search spans multiple event logs or if you need to search for events across many computers at once. In that case, PowerShell can come to the rescue."]},{"component":"p","children":["PowerShell has two cmdlets to read the event log: Get-EventLog and Get-WinEvent. Each cmdlet performs the same task in a slightly different way. Let's perform some common tasks and see how their syntax compares."]},{"component":"h2","props":{"id":"listing-event-logs"},"children":["Listing event logs"]},{"component":"p","children":["First, we can enumerate event logs. Using Get-EventLog, we can use the List parameter, while Get-WinEvent uses the ListLog parameter."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter med"},"children":[{"component":"source","props":{"srcSet":"/images/content/5ca/77c7f5a215ed6158b4570/742_-447- 742w, /images/content/5ca/77c7f5a215ed6158b4570/412_-248- 412w, /images/content/5ca/77c7f5a215ed6158b4570/206_-124- 206w","sizes":"(min-width: 870px) 412px, (min-width: 400px) 38vw, 62%"}},{"component":"img","props":{"src":"/images/content/5ca/77c7f5a215ed6158b4570/519-313-","alt":"","width":"519","height":"313","data-content-img-id":"5ca77c7f5a215ed6158b4570"}}]}]},{"component":"p","children":["I cut off the output from both commands, but when you run both, you'll immediately notice that Get-WinEvent returns ",{"component":"i","children":["a lot"]}," more logs. This is because it's capable of querying the logs that show up under Applications and Services in the event viewer, while Get-EventLog cannot."]},{"component":"h2","props":{"id":"querying-individual-event-logs"},"children":["Querying individual event logs"]},{"component":"p","children":["Once we know the logs available to query, we can then narrow down the query to a particular event log using either cmdlet."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter small"},"children":[{"component":"source","props":{"srcSet":"/images/content/5ca/77d979c658a525d8b4584/460_-77- 460w, /images/content/5ca/77d979c658a525d8b4584/255_-42- 255w, /images/content/5ca/77d979c658a525d8b4584/127_-21- 127w","sizes":"(min-width: 870px) 255px, (min-width: 400px) 100vw, 100%"}},{"component":"img","props":{"src":"/images/content/5ca/77d979c658a525d8b4584/322-54-","alt":"","width":"322","height":"54","data-content-img-id":"5ca77d979c658a525d8b4584"}}]}]},{"component":"p","children":["This will output each event in the event log you provide to the LogName parameter on either cmdlet in chronological order. But what if you need to find specific events? In that case, you'll need to filter."]},{"component":"p","children":["There are many different ways to filter events using both cmdlets, although more so with Get-WinEvent. For example, perhaps I want to see all events in my Application event log that happened a week ago or earlier. With Get-EventLog, after defining the date seven days ago, I can use the After parameter."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter med"},"children":[{"component":"source","props":{"srcSet":"/images/content/5ca/77e099c658a11578b4585/742_-82- 742w, /images/content/5ca/77e099c658a11578b4585/412_-45- 412w, /images/content/5ca/77e099c658a11578b4585/206_-22- 206w","sizes":"(min-width: 870px) 412px, (min-width: 400px) 38vw, 62%"}},{"component":"img","props":{"src":"/images/content/5ca/77e099c658a11578b4585/470-52-","alt":"","width":"470","height":"52","data-content-img-id":"5ca77e099c658a11578b4585"}}]}]},{"component":"p","children":["We can do something similar using Get-WinEvent, although this time, we have to use one of its filter parameters. In this instance, I'll use the FilterHashTable parameter."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter med"},"children":[{"component":"source","props":{"srcSet":"/images/content/5ca/77f259c658aff7c8b458f/742_-103- 742w, /images/content/5ca/77f259c658aff7c8b458f/412_-57- 412w, /images/content/5ca/77f259c658aff7c8b458f/206_-28- 206w","sizes":"(min-width: 870px) 412px, (min-width: 400px) 38vw, 62%"}},{"component":"img","props":{"src":"/images/content/5ca/77f259c658aff7c8b458f/624-87-","alt":"","width":"624","height":"87","data-content-img-id":"5ca77f259c658aff7c8b458f"}}]}]},{"component":"p","children":["Maybe we'd like to find only those events that match a specific ID. Both cmdlets can do that too."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter med"},"children":[{"component":"source","props":{"srcSet":"/images/content/5ca/77f725a215e72088b458f/742_-87- 742w, /images/content/5ca/77f725a215e72088b458f/412_-48- 412w, /images/content/5ca/77f725a215e72088b458f/206_-24- 206w","sizes":"(min-width: 870px) 412px, (min-width: 400px) 38vw, 62%"}},{"component":"img","props":{"src":"/images/content/5ca/77f725a215e72088b458f/605-71-","alt":"","width":"605","height":"71","data-content-img-id":"5ca77f725a215e72088b458f"}}]}]},{"component":"h2","props":{"id":"get-winevent-greater-get-eventlog"},"children":["Get-WinEvent > Get-EventLog"]},{"component":"p","children":["There's a lot we can do with both cmdlets, but Get-WinEvent takes the cake in sheer functionality. Excluding the fact it can query many more types of event logs than Get-EventLog, its filtering ability can't be beat."]},{"component":"p","children":["In the cases above, we were using the FilterHashTable parameter, but this is just one example. Get-WinEvent also supports filtering events by their native XML format using FilterXML. For example, if we would like to find all events with a provider name of \"disk\" in the system event log with an event ID of 1, we could define the XML as below and pass that value to the FilterXML parameter."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter med"},"children":[{"component":"source","props":{"srcSet":"/images/content/5ca/780255a215e45228b457e/742_-230- 742w, /images/content/5ca/780255a215e45228b457e/412_-127- 412w, /images/content/5ca/780255a215e45228b457e/206_-63- 206w","sizes":"(min-width: 870px) 412px, (min-width: 400px) 38vw, 62%"}},{"component":"img","props":{"src":"/images/content/5ca/780255a215e45228b457e/586-182-","alt":"","width":"586","height":"182","data-content-img-id":"5ca780255a215e45228b457e"}}]}]},{"component":"p","children":["Is defining all of that XML not your thing? No problem. We can use XPath too."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter med"},"children":[{"component":"source","props":{"srcSet":"/images/content/5ca/780af7b4374f2478b456c/742_-101- 742w, /images/content/5ca/780af7b4374f2478b456c/412_-56- 412w, /images/content/5ca/780af7b4374f2478b456c/206_-28- 206w","sizes":"(min-width: 870px) 412px, (min-width: 400px) 38vw, 62%"}},{"component":"img","props":{"src":"/images/content/5ca/780af7b4374f2478b456c/401-55-","alt":"","width":"401","height":"55","data-content-img-id":"5ca780af7b4374f2478b456c"}}]}]},{"component":"p","children":["Get-WinEvent provides many options to filter events, making it far superior to the Get-EventLog cmdlet in terms of functionality."]},{"component":"h2","props":{"id":"summary"},"children":["Summary"]},{"component":"p","children":["We just scratched the surface as to what these two cmdlets can do. In a nutshell, if you need to perform simple event log queries, Get-EventLog is probably going to be easier to work with. If you find yourself needing to create complex queries across local and remote computers, Get-WinEvent is a much better choice."]}]},"resource":null,"sponsorship":null,"thumbnail":{"path":"https://staging.business.com/images/content/5ca/782507b437408768b457f/1500-0-","caption":"REDPXEL.PL/Shutterstock / Credit: Image credit: REDPIXEL.PL/Shutterstock","isBlurred":true},"bestPicks":null},"related":{"relatedArticles":[{"title":"PowerShell: Everything You Need to Know","canonical":"https://www.business.com/articles/powershell-everything-you-need-to-know/","slug":"powershell-everything-you-need-to-know","thumbnail":"https://www.business.com/images/content/5b8/998581039eb8f738b457b/1500-0-","dek":"What you need to know to unlock Microsoft PowerShell's full capabilities.","lastModified":"2018-09-05T17:00:00Z","published":"2018-09-05T17:00:00Z","sponsored":false},{"title":"Essential PowerShell Cmdlets For Managing Active Directory","canonical":"https://www.business.com/articles/powershell-active-directory-cmdlets/","slug":"powershell-active-directory-cmdlets","thumbnail":"https://www.business.com/images/content/5cf/90cab7b4374ab068b456f/1500-0-","dek":"Administering Active Directory is one of the most critical roles in any Windows network.","lastModified":"2018-09-04T08:00:00Z","published":"2018-09-04T08:00:00Z","sponsored":false},{"title":"Essential PowerShell Cmdlets For Auditing And Maintaining Storage","canonical":"https://www.business.com/articles/powershell-for-storage/","slug":"powershell-for-storage","thumbnail":"https://www.business.com/images/content/5d0/18e065a215ea2498b4588/1500-0-","dek":"PowerShell v5 offers some new features for managing storage.","lastModified":"2018-09-04T11:00:00Z","published":"2018-09-04T11:00:00Z","sponsored":false},{"title":"Network Hardware & Assembly: LAN 102","canonical":"https://www.business.com/articles/local-area-network-hardware-assembly/","slug":"local-area-network-hardware-assembly","thumbnail":"https://www.business.com/images/content/5b1/a9a3551ee47a94d8b457a/1500-0-","dek":"Scott Mueller explains LAN hardware and assembly.","lastModified":"2018-07-11T14:46:00Z","published":"2018-07-11T14:46:00Z","sponsored":false},{"title":"Networking Basics: LAN 101","canonical":"https://www.business.com/articles/local-area-network-wi-fi-networking-basics/","slug":"local-area-network-wi-fi-networking-basics","thumbnail":"https://www.business.com/images/content/5b1/a9c8551ee47a74d8b4580/1500-0-","dek":"Learn about the glue that holds our networks together in this LAN primer.","lastModified":"2018-07-11T14:22:00Z","published":"2018-07-11T14:22:00Z","sponsored":false},{"title":"Use PowerShell to Make WSUS Suck Less","canonical":"https://www.business.com/articles/powershell-windows-software-update-services/","slug":"powershell-windows-software-update-services","thumbnail":"https://www.business.com/images/content/5b8/eca2d92a3a4ee5a8b4574/1500-0-","dek":"Windows Software Update Services can use PowerShell to work with servers and Windows.","lastModified":"2018-09-04T10:00:00Z","published":"2018-09-04T10:00:00Z","sponsored":false},{"title":"How to Create a Web Scraping Tool in PowerShell","canonical":"https://www.business.com/articles/create-web-scraping-tool-in-powershell/","slug":"create-web-scraping-tool-in-powershell","thumbnail":"https://www.business.com/images/content/5d0/06c899c658acc288b458a/1500-0-","dek":"Write a tool in PowerShell that will gather all the data from a web page.","lastModified":"2018-09-05T09:00:00Z","published":"2018-09-05T09:00:00Z","sponsored":false},{"title":"How To Remove Pre-Installed Windows 10 Applications With PowerShell","canonical":"https://www.business.com/articles/remove-pre-installed-windows-10-applications-powershell/","slug":"remove-pre-installed-windows-10-applications-powershell","thumbnail":"https://www.business.com/images/content/5d0/b99037b4374d0428b4567/1500-0-","dek":"How to quickly and easily uninstall pre-installed Windows 10 apps using PowerShell.","lastModified":"2018-09-05T08:00:00Z","published":"2018-09-05T08:00:00Z","sponsored":false},{"title":"Introduction To Using XML Files With PowerShell","canonical":"https://www.business.com/articles/powershell-read-xml-files/","slug":"powershell-read-xml-files","thumbnail":"https://www.business.com/images/content/5db/f21da9c658a05188b4577/1500-0-","dek":"PowerShell offers several ways to read XML documents, without writing a lot of code.","lastModified":"2018-09-05T12:01:00Z","published":"2018-09-05T12:00:00Z","sponsored":false},{"title":"How To Manage User Profiles With PowerShell","canonical":"https://www.business.com/articles/powershell-manage-user-profiles/","slug":"powershell-manage-user-profiles","thumbnail":"https://www.business.com/images/content/5cf/ffdf07b4374ac348b4576/1500-0-","dek":"Managing Windows user profiles can be time consuming and tedious. Here are some tips.","lastModified":"2018-09-06T07:00:00Z","published":"2018-09-06T07:00:00Z","sponsored":false},{"title":"5 Ways to Incorporate Artificial Intelligence in Your Business for Exponential Growth","canonical":"https://www.business.com/articles/how-to-implement-ai-for-business-growth/","slug":"how-to-implement-ai-for-business-growth","thumbnail":"https://www.business.com/images/content/5e5/53ed47b4374a9458b4576/1500-0-","dek":"Artificial Intelligence isn’t set to happen in the future because the future is here! Learn how to use this in your business to skyrocket your business growth.","lastModified":"2020-02-25T18:38:00Z","published":"2020-02-25T18:38:00Z","sponsored":false},{"title":"How To Sync Folders With PowerShell","canonical":"https://www.business.com/articles/powershell-sync-folders/","slug":"powershell-sync-folders","thumbnail":"https://www.business.com/images/content/5cf/f157d9c658a99338b4568/1500-0-","dek":"There is software that will sync files and folders for you, and PowerShell can help.","lastModified":"2018-09-06T09:00:00Z","published":"2018-09-06T09:00:00Z","sponsored":false}],"relatedReviews":[{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df908cc5a215e8c4a8b4568/conferencecall_Antonio_Diaz_Getty.jpg","canonical":"https://staging.business.com/categories/best-conference-call-services/","title":"The Best Conference Call Services of 2021","dek":"Which conference call service is right for your business in 2021? We review the top-rated services.","slug":"best-conference-call-services","lastModified":"2021-03-17T18:17:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df3d8695a215e58428b4570/POS_GETTY_DERO2084.jpg","canonical":"https://staging.business.com/categories/best-pos-systems/","title":"The Best POS Systems of 2021","dek":"Before you choose a POS system, check out our reviews of the best picks for 2021. ","slug":"best-pos-systems","lastModified":"2021-03-17T17:33:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5e00d4787b43745d6a8b456e/Laptop_undrey_getty.jpg","canonical":"https://staging.business.com/categories/employee-monitoring-software/","title":"The Best Employee Monitoring Software of 2021","dek":"We've narrowed down the best employee monitoring software for businesses. Check out our best picks and reviews.","slug":"employee-monitoring-software","lastModified":"2021-03-05T15:40:00Z"}],"relatedSponsoredArticles":null}},"pageContext":{"displayModified":"2019-04-08T19:00:00.000Z","template":"legacy","title":"Using PowerShell to Manage the Windows Event Log","meta":{"robots":"index, follow"},"docType":"articles","slug":"powershell-manage-windows-event-log","canonical":"https://staging.business.com/articles/powershell-manage-windows-event-log/","skipTOC":false}},"staticQueryHashes":[]}