Event logs form the core of most monitoring and
diagnosis on Windows. To support this activity, PowerShell offers both the
Get-WinEvent cmdlets to let you query and
work with event log data on a system. In addition to simple event log
retrieval, PowerShell also includes many other cmdlets to create, delete,
customize, and interact with event logs.
In addition to the (now “classic”) event logs
exposed by the
*-EventLog cmdlets, Windows Vista and
beyond have a significantly expanded and revamped event logging system
compared to Windows XP. The features of the new system are different
enough that we expose them through an entirely new
Get-WinEvent cmdlet. If you need to read events from
Vista-style event logs, you’ll need the
cmdlet. If you need to read events from classic event logs, the choice is
up to you.
You want to determine which event logs exist on a system.
To list all classic event logs on a system,
-List parameter of the
PS > Get-EventLog -List Max(K) Retain OverflowAction Entries Log ------ ------ -------------- ------- --- 20,480 0 OverwriteAsNeeded 1,933 Application 15,168 0 OverwriteAsNeeded 0 DFS Replication 20,480 0 OverwriteAsNeeded 0 HardwareEvents 512 7 OverwriteOlder 0 Internet Explorer 20,480 0 OverwriteAsNeeded 0 Key Management Service 8,192 0 OverwriteAsNeeded 0 Media Center 128 0 OverwriteAsNeeded 2 OAlerts 1,024 7 OverwriteOlder 424 ScriptEvents ...