PowerTip: Use PowerShell to Write to an Event Log

PowerTip: Use PowerShell to Write to an Event Log

  • Comments 7
  • Likes

Summary: Use the Write-Eventlog Windows PowerShell cmdlet to write to a standard or to a custom event log.

 Hey, Scripting Guy! Question How can you easily write output to an event log?

Hey, Scripting Guy! AnswerUse the Write-EventLog cmdlet, and make sure that you specify the log name and the source:

write-eventlog -logname Application -source MyApp -eventID 3001 -entrytype Information `

-message "MyApp added a user-requested feature to thedisplay." -category 1 -rawdata 10,20

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment
  • <p>When I try this I get Source was not found. </p> <p>Eventually I tried </p> <p> write-eventlog -logname system -source &#39;User32&#39; -eventID 777 -entrytype Information `</p> <p> -message &quot;Test message &quot; -category 1 -rawdata 10,20,30</p> <p>Even then it only worked when run as an administrator and the event log complained about the description for event id 777. </p> <p>How do you configure the event &nbsp;logs to take a user defined source?</p>

  • <p>Or, how do you list the valid sources using powershell?</p>

  • <p>oh, nevermind. &nbsp;i guess that&#39;s easy enough</p> <p> get-eventlog application | group-object -property source &nbsp;| select-object Name</p>

  • <p>@StaceyIsLearning, You can use New-EventLog to create the event source if it doesn&#39;t exist. Obviously, you need to be an Administrator to create the new event source.</p>

  • <p>@StaceyIsLearning, you could precede with this (as mentioned above, this part will require administrative privilege):</p> <p>if ([System.Diagnostics.EventLog]::SourceExists(&quot;MyApp&quot;) -eq $false) {</p> <p> &nbsp; &nbsp;[System.Diagnostics.EventLog]::CreateEventSource(&quot;MyApp&quot;, &quot;Application&quot;)</p> <p>}</p>

  • <p>Is it possible to create an EventID Qualifier using powershell as in the example below? </p> <p> &lt;EventID Qualifiers=&quot;45055&quot;&gt;20709&lt;/EventID&gt;</p> <p>&lt;Event xmlns=&quot;<a rel="nofollow" target="_new" href="http://schemas.microsoft.com/win/2004/08/events/event&quot;&gt;">schemas.microsoft.com/.../event&quot;&gt;</a></p> <p>- &lt;System&gt;</p> <p> &nbsp;&lt;Provider Name=&quot;BlackBerry Messaging Agen&quot; /&gt;</p> <p> &nbsp;&lt;EventID Qualifiers=&quot;45055&quot;&gt;20709&lt;/EventID&gt;</p> <p> &nbsp;&lt;Level&gt;3&lt;/Level&gt;</p> <p> &nbsp;&lt;Task&gt;0&lt;/Task&gt;</p> <p> &nbsp;&lt;Keywords&gt;0x80000000000000&lt;/Keywords&gt;</p> <p> &nbsp;&lt;TimeCreated SystemTime=&quot;2012-09-11T07:39:56.000000000Z&quot; /&gt;</p> <p> &nbsp;&lt;EventRecordID&gt;8444471&lt;/EventRecordID&gt;</p> <p> &nbsp;&lt;Channel&gt;Application&lt;/Channel&gt;</p> <p> &nbsp;&lt;Computer&gt;xxxxxxxxxx&lt;/Computer&gt;</p> <p> &nbsp;&lt;Security /&gt;</p> <p> &nbsp;&lt;/System&gt;</p> <p>- &lt;EventData&gt;</p> <p> &nbsp;&lt;Data&gt;{Fred.nerk@here.com} Failed to reach user&#39;s mailbox&lt;/Data&gt;</p> <p> &nbsp;&lt;/EventData&gt;</p> <p> &nbsp;&lt;/Event&gt;</p>

  • <p>@Brian_O Nice! :D</p>