PowerShell 2.0: One Cmdlet at a Time 69 Get-WinEvent
Continuing the series looking at new cmdlets available in PowerShell 2.0. This time we look at the Get-WinEvent cmdlet.
What can I do with it?
Retrieve items from Event Logs including event logs generated by the Windows Event Log technology, new since Windows Vista / 2008 Server, in addition to the classic System, Security and Application Logs. Note: it requires .NET Framework 3.5 or later installed.
Examples:
Retrieve events from the Setup Event Log.
Get-WinEvent -LogName Setup
You’ll see the typical information you would normally view in Event Viewer.
Get-WinEvent includes a -FilterHashTable parameter which allows you to filter results at source rather than pulling back all the events and then piping them through to Where-Object to perform filtering, so much more effiicient.
Retrieve events from the System Event Log only where the Event ID is 10148.
Get-WinEvent -FilterHashtable @{Logname=‘System’;ID=10148}
You will see that only the events with ID 10148 are returned.
How could I have done this in PowerShell 1.0?
You could have used the Get-EventLog cmdlet, however it is not able to retrieve information from event logs generated by the Windows Event Log technology such as the Setup log mentioned in the above examples.
Get-EventLog -LogName System | Where-Object {$_.EventID -eq 10148}