Show EventLog - PowerShell

Overview

The Show-EventLog cmdlet displays the specified event logs. It provides detailed information about Windows events, facilitating troubleshooting and monitoring system activities.

Syntax

Show-EventLog [-LogName] <string[]> [-Last <UInt32>] [-Newest <UInt32>] [-Oldest <UInt32>]
               [-Channel <string>] [-ErrorAction <ActionPreference>] [-Culture <CultureInfo>]
               [-Verbose] [-OutBuffer] [-OutVariable <string>] [-Confirm] [-WhatIf]

Options/Flags

-LogName: Specifies the name of the event log to display. Use an array to specify multiple logs.

-Last: Limits the results to the specified number of latest events.

-Newest: Displays the specified number of newest events.

-Oldest: Shows the specified number of oldest events.

-Channel: Filters events based on the specified channel.

-ErrorAction: Controls the behavior when errors occur.

-Culture: Specifies the culture used for date and time formatting.

-Verbose: Displays detailed information about each event.

-OutBuffer: Stores the output in a variable instead of displaying it directly.

-OutVariable: Saves the output to a specified variable.

-Confirm: Prompts the user for confirmation before executing the command.

-WhatIf: Simulates the command without actually executing it.

Examples

Display events from the System log:

Show-EventLog -LogName System

Show the latest 10 events from the Application log:

Show-EventLog -LogName Application -Last 10

Filter events by channel:

Show-EventLog -Channel Microsoft-Windows-Kernel-Power

Common Issues

  • Insufficient permissions: You might encounter access denied errors if you don’t have sufficient permissions to access the event log.
  • Event log not found: The specified event log may not exist or be accessible.
  • Invalid date or time range: Ensure that the specified time range is valid for the event log.

Integration

  • Use Where-Object to filter events based on specific criteria.
  • Pipe the output to Export-Csv to save the events to a CSV file.
  • Combine it with Get-WinEvent to retrieve events from a specific session or computer.
  • Get-WinEvent: Retrieves events from a specified session or computer.
  • New-EventLog: Creates a new event log.
  • Clear-EventLog: Clears events from a specified event log.