Learn about Windows PowerShell
Summary: Microsoft Scripting Guy, Ed Wilson, talks about using Windows PowerShell to create and to use a new event log.
Microsoft Scripting Guy, Ed Wilson, is here. Well, it’s the weekend, baby! At least for the Scripting Wife and me. You see, the Scripting Manager gave me today and Monday off as sort of “comp time” because of all the long hours I have been working recently. I said cool, and Teresa said, “I know, let’s go to the beach,” so we are back at the beach. And I am back at the coffee house, sitting near the sand and playing around with Windows PowerShell.
Now, if this sounds familiar, it is. Teresa and I headed to the beach last week and like they say in some cheesy movies, “we’re baaack …” I will admit it is really hard to see if I am taking time off, or if I am “working,” even for me, because the two activities overlap so much. If truth be told, I am sitting here right now working—but hey, it’s all fun—and I would be doing this anyway, even if I was not working, which I am not, because my boss told me to take some time off. Now, I did read about a company recently that would pay for you to take vacation—cool, I thought, but you had to leave your cell phone, laptop, surface, etc. behind. That is not a vacation—that sounds more like torture (at least to me).
One of the cool things to do with Windows PowerShell is to create my own event logs. Here, I am talking about an event log that is like one of the traditional event logs (traditional event logs are System, Security, and Application). By using Windows PowerShell, these traditional types of event logs are easy to read, easy to write to, easy to back up, and easy to clear.
I use the New-EventLog cmdlet to create a new event log. To use this cmdlet, I need three things:
The following command creates a new traditional event log named ScriptingGuys with a source named scripts.
New-EventLog -LogName ScriptingGuys -Source scripts
When the command runs, no output appears to the Windows PowerShell console. To ensure the command actually created a new event log, I use the Get-EventLog cmdlet with the –List parameter. Here is the command and the associated output.
10:06 C:\> Get-EventLog -List
Max(K) Retain OverflowAction Entries Log
------ ------ -------------- ------- ---
20,480 0 OverwriteAsNeeded 18,504 Application
20,480 0 OverwriteAsNeeded 0 HardwareEvents
512 7 OverwriteOlder 0 Internet Explorer
20,480 0 OverwriteAsNeeded 0 Key Management Service
10,240 0 OverwriteAsNeeded 4 Lenovo-Customer Feedback
512 7 OverwriteOlder 2 Lenovo-Lenovo Patch Utility/Admin
128 0 OverwriteAsNeeded 30 OAlerts
512 7 OverwriteOlder 0 ScriptingGuys
20,480 0 OverwriteAsNeeded 21,437 System
15,360 0 OverwriteAsNeeded 10,059 Windows PowerShell
One of the things I notice when I check the ScriptingGuys event log is that it is set to 512 KB, and it will retain entries for 7 days when it will begin deleting older events. This is not the behavior I want. What I want is for the log to be 64 KB in size and to overwrite as needed. To do this, I would think that I use the Set-EventLog cmdlet—but no, there is not such a thing. The cmdlet is named Limit-EventLog. Looking at the Help, it appears there is only one parameter set. Well, I want to OverWriteAsNeeded, so I guess I also need to set a retention days of 0. I craft the following command, but as you can see, it fails.
10:19 C:\> Limit-EventLog -OverflowAction OverWriteAsNeeded -RetentionDays 0 -Maximum
Limit-EventLog : Cannot validate argument on parameter 'RetentionDays'. The 0 argument is less than the minimum allowed range of 1. Supply an argument that is greater than or equal to 1 and then try the command again.
At line:1 char:65
+ Limit-EventLog -OverflowAction OverWriteAsNeeded -RetentionDays 0 -MaximumSize
+ CategoryInfo : InvalidData: (:) [Limit-EventLog], ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell
Major bummer. Ok, so I try it without the RetentionDays parameter … and it works.
Limit-EventLog -OverflowAction OverWriteAsNeeded -MaximumSize 64KB -LogName scriptingguys
I now use Get-EventLog to confirm my changes took place … the output below confirms that the command worked properly.
10:23 C:\> Get-EventLog -list | ? log -eq scriptingguys
64 0 OverwriteAsNeeded 0 ScriptingGuys
Interestingly enough, I cannot get an event log that has no entries in it … at least not yet. Because if I use the Get-EventLog cmdlet to attempt to retrieve the ScriptingGuys event log, an error appears. The command and error are here.
10:23 C:\> Get-EventLog -LogName scriptingguys
Get-EventLog : No matches found
At line:1 char:1
+ Get-EventLog -LogName scriptingguys
+ CategoryInfo : ObjectNotFound: (:) [Get-EventLog], ArgumentException
+ FullyQualifiedErrorId : GetEventLogNoEntriesFound,Microsoft.PowerShell.Comman
To write to my new event log, I need to specify the following information:
In this example, I add a new entry to the ScriptingGuys event log.
Write-EventLog -LogName ScriptingGuys -Source scripts -Message "Dude, it works ... COOL!" -EventId 0 -EntryType information
I can now use the Get-EventLog cmdlet to retrieve the event. This is shown here.
10:27 C:\> Get-EventLog -LogName scriptingguys
Index Time EntryType Source InstanceID Message
----- ---- --------- ------ ---------- -------
1 Jan 29 10:27 Information scripts 0 Dude, it wor...
That is all there is to using Windows PowerShell to create and to manage event logs. Join me tomorrow when I will talk about more cool stuff.
I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at firstname.lastname@example.org, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.
Ed Wilson, Microsoft Scripting Guy
Hey, I want to create a event log when the number of TIME_WAIT ports reach a certain Threshold.
$c = netstat -aonp TCP | select-string "TIME_WAIT"; $c.count
How to set Threshold
How to write to EventLog when THreshold is reached.
simply create a condition on $c that check if your time_wait = your threshold then write an eventlog entries as the condition method.
Thank you Ed, this just answered my question! Any chance you could look at this using new-winevent?
How do you create subfolder in event viewer? For example, I want to create a folder for my application; then different logs for each component of my application. Is that possible via Powershell?
Hey, I want to create a new EventLog for an application running on my server and the log should be taken from the default log file of the application.
Any idea on how to achieve this??.