Search notes:

PowerShell cmdLet Get-WinEvent

get-winEvent  application
get-winEvent  system
get-winEvent  setup        # Note: get-eventLog setup is not possible
get-winEvent  security     # requires admin privileges

get-winEvent -providerName Microsoft-Windows-Kernel-Power

-ListLog

Without admin privileges:

PS C:\> get-winEvent -listLog *

LogMode   MaximumSizeInBytes RecordCount LogName
-------   ------------------ ----------- -------
Circular            15728640       12392 Windows PowerShell
Circular            20971520       31792 System
Get-WinEvent : Could not retrieve information about the Security log. Error: Attempted to perform an unauthorized operation..

With admin privileges

PS C:\> get-winEvent -listLog *

LogMode   MaximumSizeInBytes RecordCount LogName
-------   ------------------ ----------- -------
Circular            15728640       12392 Windows PowerShell
Circular            20971520       31792 System
Circular            20971520       25200 Security
Circular             1052672           0 Palo Alto Networks
Circular             1052672         107 OneApp_IGCC
Circular             1052672        1517 OAlerts
Circular            20971520           0 Key Management Service
Get-WinEvent : Could not retrieve information about the Internet Explorer log. Error: Attempted to perform an unauthorized operation..

PS C:\> get-winEvent -listLog * -errorAction silent

Find a log name

get-winEvent -listLog * -errorAction silent | where { $_.logname -match 'hyper-v' }

-LogName

Use get-winevent -LogName Microsoft-Windows-Hyper-V-Hypervisor* -MaxEvents 20 | select id, message, providername to find a log name.

get-winevent -LogName Microsoft-Windows-Hyper-V-Hypervisor* -MaxEvents 20 | select id, message, logname

-ProviderName

Why?

PS C:\> get-winEvent -ProviderName *
Get-WinEvent : Could not retrieve information about the Microsoft-System-Diagnostics-DiagnosticInvoker provider. Error: The resource loader cache doesn't have loaded MUI entry.

This seems to work better:

get-winEvent -ProviderName Microsoft-Windows-Hyper-V-Hypervisor -maxEvents 20

-FilterXml

$time_from = (get-date).AddHours(-10).ToString( "yyyy-MM-ddTHH:mm:ss.fffZ" )

[xml] $qry = @"
  <QueryList>
    <Query Id="0" Path="Security">
      <Select Path="Security">
        *[System[TimeCreated[@SystemTime &gt;= '$time_from' ]]]
      </Select>
    </Query>
  </QueryList>
"@

get-winEvent -filterXml $qry

TODO: get-winEvent vs get-eventLog

get-winEvent will eventually(?) replace get-eventLog

get-eventLog only queries the «traditional» event logs (system, application and security), it cannot query ETL type of logs.

get-eventLog is easier to use than get-winEvent.

get-winEvent setup is possible, get-eventLog setup throws an error.

get-eventLog returns instances of System.Diagnostics.EventLogEntry objects, get-winEvent instances of System.Diagnostics.Eventing.Reader.EventLogRecord.

Links

Use PowerShell Cmdlet to Filter Event Log for Easy Parsing

Index

Fatal error: Uncaught PDOException: SQLSTATE[HY000]: General error: 8 attempt to write a readonly database in /home/httpd/vhosts/renenyffenegger.ch/php/web-request-database.php:78 Stack trace: #0 /home/httpd/vhosts/renenyffenegger.ch/php/web-request-database.php(78): PDOStatement->execute(Array) #1 /home/httpd/vhosts/renenyffenegger.ch/php/web-request-database.php(30): insert_webrequest_('/notes/Windows/...', 1788302101, '216.73.217.21', 'Mozilla/5.0 App...', NULL) #2 /home/httpd/vhosts/renenyffenegger.ch/httpsdocs/notes/Windows/PowerShell/command-inventory/noun/winEvent/get/index(140): insert_webrequest() #3 {main} thrown in /home/httpd/vhosts/renenyffenegger.ch/php/web-request-database.php on line 78