Ezine 210 PowerShell Get-WinEvent

PowerShell’s Get-WinEvent

I have a new mission.  My aim is to collect a bank of simple PowerShell scripts that ‘do stuff’.  Perhaps you can help?  I am so serious about my project that this week I am offering a bounty of $10 for the best script based on Get-WinEvent.  If this is successful, then I will offer more bounties for scripts based on other cmdlets.

Guy’s Brief / Challenge:

1. Use the cmdlet: Get-WinEvent
2. Your PowerShell script must do something useful.
3. No more than 10 lines.
4. No copying from the internet!  It must be your code.
5. The best script gets $10 paid into its writer’s PayPal account.

Topics for PowerShell Get-WinEvent

• This Week’s Secret
• Example: Finding the Most Common Log Events
• PowerShell Show-Command
• Guy’s Brief / Challenge

 ♣

This Week’s Secret

Get-WinEvent is PowerShell’s 2.0’s updated version of Get-Eventlog in 1.0.  The first thing to note is when you enumerate the logs you need to append -listlog *.  (Not -list, not -loglist, and not -listlog without a wildcard).  Instead of about 8 logs, Get-WinEvent returns 150 – really!  Thus the second thing is you may want to try this filter, which just lists the traditional event logs.

Note 0: Get-WinEvent needs Vista or later, for XP use plain Get-Eventlog.

Note 1:  Perhaps my worst kept secret is that you don’t really need me, just call for PowerShell’s Get-Help!

Note 2:  Observe the -maxEvents switch, this replaces -newest in the old Get-Eventlog cmdlet.  I think this is a wonderful parameter to speed up the script when testing, and for checking properties with Get-Member

Note 3:  Most scripts which employ the Get-WinEvent cmdlet require the name of the log, for example, Application, Security, or as in this case, System.

Now you have all the tools to create interesting scripts which ‘do stuff’ such as filtering only errors, or finding messages containing specific words.

Guy Recommends: WMI Monitor and It’s Free!

Windows Management Instrumentation (WMI) is one of the hidden treasures of Microsoft’s operating systems.  Fortunately, SolarWinds have created a Free WMI Monitor so that you can discover these gems of performance information, and thus improve your scripts.

Take the guess work out of which WMI counters to use when scripting the operating system, Active Directory or Exchange Server. Give this WMI monitor a try – it’s free.

Download your free copy of WMI Monitor

Example Script: Finding the Most Common Log Events

Scripting the event logs inevitably throws up some unexpected results, errors that you really should know about and take action.  The easiest way to check for the most the serious problems is to group similar events and then list them in descending order.

In terms of my $10 challenge this is the benchmark.  I am not looking for complex coding, more focussing on a real task which a simple PowerShell script can provide a quick answer.

Note 4:  I have selected the System log, but you could easily adapt this script for the Security or Application log.

Note 5:  Once the script works, I would remove the -maxEvents 2000 part, I only added that parameter to speed-up the script when you first run it.

Reminder of Guy’s Brief / Challenge:

1. Use the cmdlet: Get-WinEvent
2. Your PowerShell script must do something useful.
3. No more than 10 lines.
4. No copying from the internet!  It must be your code.
5. The best script gets $10 paid into its writer’s PayPal account.

Summary of PowerShell’s Get-WinEvent

Everyone should check their event logs more often.  With PowerShell you can turn a drudge into a labor of love.  While you discover errors and take corrective actions, so you learn more about PowerShell’s syntax.

Guy Recommends: Tools4ever’s UMRA

Tired of writing scripts? The User Management Resource Administrator solution by Tools4ever offers an alternative to time-consuming manual processes.

It features 100% auto provisioning, Helpdesk Delegation, Connectors to more than 130 systems/applications, Workflow Management, Self Service and many other benefits. Click on the link for more information onUMRA.

See more PowerShell examples to read, write and list Windows event logs

• PowerShell Home   • Get-Eventlog   • EventVwr -list   • Get-WinEvent   • Remote-WinEvent

• WMI Win32_NTLogEvent   • Windows 8 Event Viewer  • Windows 8 Security Event Log

• PowerShell real-life task   • Write-Eventlog   • EventVwr errors   • Log Event Manager

Please email me if you have a better example script. Also please report any factual mistakes, grammatical errors or broken links, I will be happy to correct the fault.