Custom Search

---

---

Guy recommends:
Free network monitor

Solarwinds' free monitor makes it easy to check the performance and health of a router or firewall.

Download your free Network Device Monitor

---

---

Guy's Review of
Computer Utilities

 1) FreePing
 2) Engineer's Toolset
 3) Xobni
 4) PuTTY
 5) WMI Monitor
 6) BgInfo
 7) Net-SNMP
 8) IP Address Tracker
 9) DNS Stuff
10) WinDiff Compare

---

PowerShell Get-Eventlog Remote Computer

Introduction to Scripting Eventlog on a Remote Computer

Remoting is the biggest improvement in PowerShell v 2.0.  Here on this page we will see how it's possible to apply the -computer parameter to eventlog files, and thus view errors on a network computer.

PowerShell Eventlog Topics

• Example 1:  PowerShell Eventlog on Local Computer
• Example 2:  Get-Eventlog on Remote Computer
• Example 3:  PowerShell Get-Eventlog Remote EventID
• Example 4:  Alternative Technique Using System.Diagnostics
• Summary of Eventlog

 ♣

PowerShell Pre-requisites and Checklist

In the case of Windows 7 and Server 2008, you don't need to download any extra files, just 'Add Feature' Windows PowerShell.  However, for older operating systems, installing can be confusing because there are different versions of PowerShell for XP, Windows Server 2003 and Vista.  For such legacy systems only, you need to download PowerShell from Microsoft's site.

Once you have installed PowerShell 2.0, I recommend choosing the ISE (Integrated Scripting Engine) version, it will save you buying a text editor.

Example 1: PowerShell Eventlog on Local Computer

My learning progression is to get a basic example working on the local machine and then adapt the script to interrogate a remote computer.

Example 2: PowerShell Get-Eventlog on Remote Computer

Here is a modification of Example 1 which makes the script ready-to-run on a remote computer.

Note 1:  All you have to do is change "LocalHost" to a computer name on your network.

Note 2:  PowerShell v 2.0 brings with it remoting capabilities which you access via the -computer parameter.

Troubleshooting Remoting:  If the script works on your local machine, but not the network computer, see how to set up TrustedHosts

Guy Recommends:  Solarwinds' Free Bulk Import Tool

Import users from a spreadsheet.  Just provide a list of the users with their fields in the top row, and save as .csv file.  Then launch this FREE utility and match your fields with AD's attributes, click to import the users.  Optionally, you can provide the name of the OU where the new accounts will be born.

There are also two bonus tools in this free download, and all 3 have been approved by Microsoft:

1. Bulk-import new users into Active Directory.
2. Seek and zap unwanted user accounts.
3. Find inactive computers.

Download your FREE bulk import tool.

Example 3: PowerShell Get-Eventlog Remote EventID

PowerShell's Get-Eventlog is tricky to operate.  What makes it easier is focussing on the parameters, especially -logname and for remoting, -computer.  Once you get the basics working there is a wealth of techniques and properties you can apply to this most versatile cmdlet.

Scenario: You need to investigate a particular EventID. 
Important:  Amend my value of -lt '100' to -eq 'YourNumber'.  Do remember the speech marks.
Optional: Change "LocalHost" to "YourNetworkMachine"

Note 3: Please change -lt to -eq, and '100' to the EventID you are researching.

Note 4: The above script is ready for remoting, just change the value of $Machine variable.

Note 5: See more on PowerShell remoting

Guy Recommends:  Solarwinds' Log & Event Management Tool

LEM will alert you to problems such as when a key application on a particular server is unavailable.  It can also detect when services have stopped, or if there is a network latency problem.  Perhaps this log and event management tool's most interesting ability is to take corrective action, for example by restarting services, or isolating the source of a maleware attack.

Yet perhaps the killer reason why people use LEM is for its compliance capability, with a little help from you, it will ensure that your organization complies with industry standards such as CISP or FERPA.  LEM is a really smart application that can make correlations between data in different logs, then use its built-in logic to take corrective action, to restart services, or thwart potential security breaches.

Download your FREE trial of Solarwinds Log & Event Management tool.

Example 4: Alternative Eventlog Technique Using System.Diagnostics

Learning Points

Note 1:  New-Object creates an instance of system.diagnostics.  In particular an eventlog instance

Note 2:  I have used variables to control the output, $Log, $Computer and $ID.

Important: Please amend $Computer = "LocalHost" to the name of the remote computer.

More Ideas:  Introduce an $array and a loop to interrogate a batch of computers.

Further Research on PowerShell Get-Eventlog

To get the most out of Get-Eventlog even experts turn to the trusty PowerShell techniques of Get-Help and Get-Member.  Once you understand the basics, there is huge enjoyment and satisfaction in getting the right script for the right job.

Research Get-Eventlog Parameters

Checking the help file will reveal useful parameters.  Always remember to define the log with -logfile.  I particularly like the -newest, but for detailed research -before or -after maybe more useful.

Research Get-Eventlog Properties

When you define the output with Format-Table or Out-File, it makes life easier if you can choose just the relevant properties, for example, Source, TimeWritten and Message.

Researching Similar PowerShell Cmdlets

The main result is to realize there is a sister command Write-Eventlog, you could also Clear-Eventlog.

Summary of Eventlog on Remote Computer

Remoting is the biggest improvement in PowerShell v 2.0.  On this page we have seen the importance of the -computer parameter for interrogating eventlog files.  As a bonus we have experimented with listing EventIDs on both local and remote computers.

See more PowerShell examples to read, write and list Windows event logs

• PowerShell Home   • Get-Eventlog   • EventVwr -list   • Get-WinEvent   • Remote Eventlog

• WMI Win32_NTLogEvent   • Windows 8 Event Viewer  • Windows 8 Security Event Log

• PowerShell real-life task  • Write-Eventlog   • EventVwr errors   • Diagnostics   • Error examples

Please email me if you have a better example script. Also please report any factual mistakes, grammatical errors or broken links, I will be happy to correct the fault.

 *

Custom Search

Guy Recommends: WMI Monitor and It's Free! Windows Management Instrumentation (WMI) is one of the hidden treasures of Microsoft operating systems. Fortunately, Solarwinds have created the Free WMI Monitor so that you can actually see and understand these gems of performance information.  Take the guess work out of which WMI counters to use for applications like Microsoft Active Directory, SQL or Exchange Server. Download your free copy of WMI Monitor

Home Copyright © 1999-2012 Computer Performance LTD All rights reserved Please report a broken link, or an error.