Get-PowerShell | Searching Event Logs with Powershell

Andy Schneider is a Systems Engineer at Avanade, a company that was started in 2000 to merge leading enterprise technology solutions with cutting-edge business consulting capabilities. Andy is a member of the IT Infrastructure Hosting team for Avanade's IT Services. He focuses on virtualization using Hyper-V and has done a lot of work with NetApp storage devices. Andy uses PowerShell on a daily basis to manage Hyper-V, Microsoft Clusters, and NetApp storage devices. When Andy is not writing PowerShell code, you can find him spending time with his beautiful wife and two daughters or working out at Kirkland Crossfit. You can find Andy's personal PowerShell blog at http://get-powershell.com and follow him on twitter at @andys146.

<< Objects or Text in a pipeline ? | Enabling WinRM with Powershell >>

Searching Event Logs with Powershell

March 27, 2008 at 2:03 PM — Andy Schneider

I recently had a situation where I needed to be able to search an event log for a particular value.

I wrote a quick little script so that our PM could run it with little effort

   1: param ($name)   2: $user = '*' + $name + '*'   3: get-eventlog application | where {$_.Message -like $user} |    4: format-list Message,TimeGenerated

I am basically searching for event logs that contain a particular name.

It's pretty straight forward once you find that .Message is what contains the real meat of the event log entry.

You could also obviously use get-eventlog system as well.

a22f6fac-938f-4ebb-8d58-7fb7447d6ce5|0|.0

Posted in:

Tags:

NetApp PowerShell Toolkit has a PowerShell ProviderI was at the PowerShell Deep Dive the first half of this week. During a break, I had the chance to m...The How and Why of Learning to Use PowerShell (Part 1 of more than 1)Two years ago, I spent a great deal of time evangelizing PowerShell within my company and publicly a...Single Threaded Apartment in PowerShell V1I’ve been working on a Winform that I use in a PowerShell script and I needed to display HTML in the...

Comments (1) -

Joel Bennett says:

March 29, 2008 at 3:03 PM

Or any of your other event logs, like "Microsoft PowerShell" ... use Get-EventLog -List to see what's available on your system...

Get-PowerShell Andy Schneider's Blog about Windows PowerShell

Month List

Searching Event Logs with Powershell

Related posts

Comments (1) -

Add comment