{"id":342,"date":"2006-12-04T04:00:00","date_gmt":"2006-12-04T12:00:00","guid":{"rendered":"http:\/\/testblog.sapien.com\/index.php\/2006\/12\/04\/powershell-event-log-filtering\/"},"modified":"2006-12-04T04:00:00","modified_gmt":"2006-12-04T12:00:00","slug":"powershell-event-log-filtering","status":"publish","type":"post","link":"https:\/\/dev.sapien.com\/blog\/2006\/12\/04\/powershell-event-log-filtering\/","title":{"rendered":"PowerShell Event Log Filtering"},"content":{"rendered":"

I recently helped a fellow scripting admin with a PowerShell problem in the ScriptingAnswers.com PowerShell <\/a>forum. He wanted to get Errors and Warnings that had happened in the last 30 minutes.  Using the Get-EventLog cmdlet would seem like the write solution but it takes a little wrangling to get the information you want.  One of the first challenges is that there does not appear to be a way to specify more than one logfile. The -logname parameter does not take a wildcard or multiple values. However, you can get a list of logfile names with -list.  That might be promising.  I can create an object that contains a list of all the logfiles on my system like this:<\/p>\n

$logfiles=Get-EventLog -list -asString<\/span><\/p>\n

I use -asString because I want just the name of the logfile, not the logfile object.  Now, what about filtering by the TimeWritten property? That is actually pretty easy. A datetime object has several methods such as AddDays,AddHours and AddMinutes. All I need to do is add a negative number of minutes from the current time like this:<\/p>\n

$d=Get-Date<\/span>
$lastweek= $d.AddDays(-7) <\/span><\/p>\n

This will create an object ($lastweek) that is a datetime value of 7 days ago from now.  Next I need to filter out just Warnings or Errors. Each eventlog entry object has a property of EntryType.  All I need to do is find entries where EntryType -eq “Error” or EntryType -eq “Warning.”<\/p>\n

Maybe you can see where I’m heading with this.  Here’s script:<\/p>\n

$d=Get-Date<\/span>
$recent= $d.AddDays(-1)   <\/span>
$logfiles=Get-EventLog -list -asString<\/span>
foreach ($log in $logfiles) {<\/span>
Write-Host -foregroundcolor Red -backgroundcolor Yellow `<\/span>
$log.ToUpper() “Event Log”<\/span>
Get-EventLog -logname $log | where `<\/span>
{($_.EntryType -eq “Warning” -OR $_.EntryType -eq “Error”) `<\/span>
-AND ($_.TimeWritten -ge $recent)}<\/span>
}<\/span><\/p>\n

This script will display all errors and warnings from all event logs on my system that occurred within the last day. The heavy lifting is done by this Where expression:<\/p>\n

where <\/span>{($_.EntryType -eq “Warning” -OR $_.EntryType -eq “Error”) <\/span>-AND ($_.TimeWritten -ge $recent)<\/span><\/p>\n

The expression has some compound queries. First I need events where the type is either Warning or Error and then the TimeWritten must be greater or equal to a datetime value of 1 day ago.<\/p>\n

You can easily modify the script for a different time range, specific log files or specific log types. If you’re wondering how I knew what the eventlog properties were, you can see for yourself with a command like this:<\/p>\n

 get-eventlog -logname application -newest 1 |get-member<\/span>

You can modify the query accordingly if you want to display additional information.<\/p>\n

The downside to Get-Eventlog is that it only works on the local system. I’ll show you how to take another approach if you want to query a remote server another day.<\/p>\n","protected":false},"excerpt":{"rendered":"

I recently helped a fellow scripting admin with a PowerShell problem in the ScriptingAnswers.com PowerShell forum. He wanted to get Errors and Warnings that had happened in the last 30 minutes. Using the Get-EventLog cmdlet would seem like the write solution but it takes a little wrangling to get the information you want.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[2,25],"tags":[],"class_list":["post-342","post","type-post","status-publish","format-standard","hentry","category-general","category-windows-powershell"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/342","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/comments?post=342"}],"version-history":[{"count":0,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/342\/revisions"}],"wp:attachment":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/media?parent=342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/categories?post=342"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/tags?post=342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}