Vista Event Logs and PowerShell

benp — Tue, 30 Oct 2007 17:40:00 GMT

Hello Everybody

Sorry for the huge delay in posting anything, I promise I will never leave it so long again.

I got asked a question the other day. Can I use Get-EventLog to access all the new logs that are in Vista?

Which logs am I referring to you may ask. Well, there are loads of new logs that can provide a massive set of troubleshooting information. Here's a screen shot from my Vista laptop that shows some of the logs:

So the question is can I query the Backup, Bits-Client, DiskDiagnostic and all the other logs using the Get-Eventlog cmdlet.

In short no. You can however still use PowerShell, but you need to use a command line tool that ships in Vista, wevtutil.exe. You can find out all the logs that can be accessed using Get-Eventlog with the -list parameter.

PS C:\Users\benp> Get-EventLog -list

  Max(K) Retain OverflowAction        Entries Name
  ------ ------ --------------        ------- ----
  15,168      0 OverwriteAsNeeded       1,381 Application
  15,168      0 OverwriteAsNeeded           0 DFS Replication
  20,480      0 OverwriteAsNeeded           0 Hardware Events
     512      7 OverwriteOlder              0 Internet Explorer
     512      7 OverwriteOlder              0 Key Management Service
   8,192      0 OverwriteAsNeeded           0 Media Center
  16,384      0 OverwriteAsNeeded           0 Microsoft Office Diagnostics
  16,384      0 OverwriteAsNeeded          29 Microsoft Office Sessions

  15,168      0 OverwriteAsNeeded       4,109 System
  15,360      0 OverwriteAsNeeded          40 Windows PowerShell

All of the above logs are part of the standard Windows Event Log. However, all of the the other logs in the screenshot use Windows Eventing 6.0. Get-EventLog does not hook into Windows Eventing 6.0.

So how can I get at these logs using PowerShell? Check out the sample below:

PS C:\Users\benp> wevtutil.exe qe Microsoft-Windows-UAC/Operational /c:2 /f:text
Event[0]:
  Log Name: Microsoft-Windows-UAC/Operational
  Source: Microsoft-Windows-UAC
  Date: 2007-10-30T11:14:00.524
  Event ID: 1
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-21-1721234763-462695806-1538865281-2692397
  User Name: testdom\benp
  Computer: vista.test.microsoft.com
  Description:
The process failed to handle ERROR_ELEVATION_REQUIRED during the creation of a child process.

This sample connects to the UAC Operational log and displays the newest 2 items as text. (There is only 1 event listed, because I only have 1 entry in the log).

So yes I can access these logs using PowerShell, but no I can't use the Get-EventLog cmdlet to do it. Check out the following link for detailed syntax for using wevtutil.exe

http://technet2.microsoft.com/windowsserver2008/en/library/d4c791e0-7e59-45c5-aa55-0223b77a48221033.mspx?mfr=true

Thanks to Narayanan Lakshmanan for answering the many questions I had about this.

That is all

BenP

Benp's Guide to Stuff : vista

Vista Event Logs and PowerShell