You probably have used Get-EventLog frequently to dump event log information, for example:

 
PS> Get-EventLog -LogName System -EntryType Error -Newest 6

   Index Time          EntryType   Source                 InstanceID Message
   ----- ----          ---------   ------                 ---------- -------
    5237 Jul 31 12:39  Error       DCOM                        10016 The des...
    5234 Jul 31 09:54  Error       DCOM                        10016 The des...
    5228 Jul 31 09:46  Error       DCOM                        10016 The des...
    5227 Jul 31 09:40  Error       DCOM                        10016 The des...
    5218 Jul 31 09:38  Error       DCOM                        10016 The des...
    5217 Jul 31 09:38  Error       DCOM                        10016 The des...



PS>
 

If you’d like to create useful reports, though, make sure you format the output table and enable line wraps:

 

PS> Get-EventLog -LogName System -EntryType Error -Newest 6 | Format-Table -AutoSize -Wrap
 

Now you can easily pipe the results to Out-File and create meaningful text reports. Play with its -Width parameter to adjust the width of your report file as well.

And if you don’t know the exact name of a particular log, simply use “*” for -LogName:

 
PS> Get-EventLog -LogName * 

  Max(K) Retain OverflowAction        Entries Log                                                         
  ------ ------ --------------        ------- ---                                                         
  20.480      0 OverwriteAsNeeded      13.283 Application  
     512      7 OverwriteOlder             98 Dell      
  20.480      0 OverwriteAsNeeded           0 HardwareEvents
     512      7 OverwriteOlder              0 Internet Explorer
     512      7 OverwriteOlder             46 isaAgentLog
  20.480      0 OverwriteAsNeeded           0 Key Management Service
     128      0 OverwriteAsNeeded          97 OAlerts 
                                              Security
  20.480      0 OverwriteAsNeeded       5.237 System
  15.360      0 OverwriteAsNeeded      10.279 Windows PowerShell
 

Twitter This Tip! ReTweet this Tip!

Anonymous