Saturday, August 20, 2016

PowerShell - Read the Event Log

# Retrieve ten most recent events in the system log
Get-EventLog -LogName System -Newest 10 -ComputerName "changeme"

# Retrieve entries from today
Get-EventLog -LogName System -ComputerName "changeme" -After ( [datetime]::Today )

# Retrieve entries from today and yesterday
Get-EventLog -LogName System -ComputerName "changeme" -After ( [datetime]::Today.AddDays(-1) )

# Another way
$time = [datetime]::Today.AddDays(-1)
Get-WinEvent –FilterHashtable @{logname=’system’; starttime=$time } –MaxEvents 10 -ComputerName "changeme"

# Now store events in an array

$time = [datetime]::Today.AddDays(-1)
$array = Get-WinEvent –FilterHashtable @{logname=’system’,'application'; starttime=$time } –MaxEvents 50 -ComputerName "changeme" 

Write-Host $('-' * 70)

# Display the first five events captured
$array[1..5]