Taking on PowerShell one cmdlet at a time

Share this post:This blog post is part of an ongoing series by Adam Gordon. Adam will show you how to use each PowerShell command each week. Adam will be covering Get-WinEvent this week.

When to use GetWinEvent
The Get-WinEvent cmdlet retrieves events from all logs, including the System and Application logs. Get-WinEvent returns event information by default in the order from newest to oldest.
Get-WinEvent lists event logging providers and event logs. Get-WinEvent lets you filter events using XPath, structured XML queries and hash table queries.
PowerShell may not be run as an Administrator if you see error messages.

How to use GetWinEvent
All logs can be downloaded from a local computer
Get-WinEvent -ListLog *
Logs will be listed in the order they are received by Get-WinEvent.
The classic logs are first retrieved, followed by the Windows Event logs.
It is possible for a log’s RecordCount null to exist. This means that it is either blank or zero.

Event logs available from multiple servers
$S = 'Server01', 'Server02', 'Server03'ForEach ($Server in $S) Select-Object LogMode, MaximumSizeInBytes, RecordCount, LogName, @name='ComputerName'; expression=$Server 12345678$S = 'Server01', 'Server02', 'Server03'ForEach ($Server in $S) Select-Object LogMode, MaximumSizeInBytes, RecordCount, LogName, @name='ComputerName'; expression=$Server The variable $S stores the names of the three servers: Server01, Server02, and Server03.
ForEach uses a loop to process each server ($Server in $S).
The script block located in the curly braces (” “) runs the Get-WinEvent command.
The -ListLog parameter specifies which Application log. The -ComputerName parameter uses $Server to retrieve log information from each server.
The objects are sent to the Select-Object cmdlet via the pipeline. Select-Object receives the properties LogMode and MaximumSizeInBytes as well as RecordCount and LogName. It then uses a calculated expression that displays the ComputerName using $Server variable.
The objects are sent to the Format-Table cmdlet, which displays the output in PowerShell console. The -AutoSize parameter formats output to fit the screen.

All event log providers that write to one log are available:
(Get-WinEvent -ListLog Application).ProviderNames
The -ListLog parameter uses Application for objects to be obtained for this log.
ProviderNames is a property that identifies the object and lists the providers who have written to the Application log.

Get the Event IDs generated by the event provider:
(Get-WinEvent -ListProvider Microsoft-Windows-GroupPolicy).Events | Format-Table Id, Description
The -ListProvider parameter specifies the provider, Microsoft-Windows-GroupPolicy.
The expression is enclosed in parentheses. It uses the Events property for objects.
The objects are sent to the Format-Table cmdlet via the pipeline. Format-Table displays the Id of the event objects and the Description.

Get error events with a specific string in their names:
Get-WinEvent -LogName *PowerShell*, Microsoft-Windows-Kernel-WHEA* | Group-Object -Property LevelDisplayName, LogName -NoElement | Format-Table -AutoSize
The -LogName parameter uses the asterisk (*), wildcard, and a comma separated string to specify the log names.
The objects are sent through the pipeline to the Group Object cmdlet. Group-Object uses -Property to group objects by LevelDisplayName or LogName.
The -NoElement parameter removes any other properties from the output.
The grouped objects are then sent down the pipeline to Format-Table cmdlet.
Format-Table uses -AutoSize to format the columns.
The total number of events is shown in the Count column. The Name column contains the LogName and LevelDisplayName.

FilterHashtable is a way to extract events from the Application log.
$Date = (Get-Date).AddDays(-2)
Get-WinEvent -FilterHashtable @ LogName=’Application’; StartTime=$Date; Id=’1003′
The Get-Date cmdlet uses AddDays to find a date that is at least two days ahead of the current date. The $Date variable stores the date object.
To filter the output, you can use the -FilterHashtable parameter.
The LogName key specifies what value is used for the Application log.
The $Date variable value is used by the StartTime key. The Event Id value is 1003.

Test-Path: Learn the command last week
Do you need PowerShell training? ITProTV offers PowerShell online IT training.