Examples of using Get-EventLog to read and filter system logs in PowerShell

This article introduces the use of PowerShell to read system logs, which can be filtered by multiple factors such as log name, log type, and time. PowerShell provides a cmdlet called Get-EventLog, which can use it to read system logs.

Run the Get-EventLog cmdlet and try:

Copy the codeThe code is as follows:

PS C:\Users\zhanghong> Get-EventLog -LogName System

oh! If you feel that you are being hurt by the editor and the cmd window is scrolling constantly, then press Ctrl+C to stop it first. Then I explain that the reason this happens is because your system log has too much content. However, if you have good patience, you can wait for it, and it will always be output and stop.

OK, if we want to read the log like this, we would rather die, right? ! What should I do? Filter it. For example, I just want to see the error log in the system log.

Copy the codeThe code is as follows:

PS C:\Users\zhanghong> Get-EventLog -LogName System -EntryType Error

Is it a little less than before? Oh, if you say that your results are so much that you can't read, the screen will scroll endlessly. Then let’s further screen. For example, just look at today's error log. Brother Hong’s current date is 2013-9-18, so my command is written like this:

Copy the codeThe code is as follows:

PS C:\Users\zhanghong> Get-EventLog -LogName System -EntryType Error -After 2013-9-18

Now, there are not so many records. If there are really many error logs, is it time for your system to redo? Well, don't learn PowerShell first, rework the computer first.

OK, this article introduces so much about using PowerShell to read system logs. As for what is the use of reading it, uh, what do you think?