PowerShell Get-EventLog: Read Windows Event Logs
─□✕

PowerShell Get-EventLog: Read Windows Event Logs

PowerShell Tips Editor 4 min read
PowerShell Get-EventLog: Read Windows Event Logs

When something breaks on a Windows server, the event log holds the answer — but clicking through Event Viewer on 20 machines is not root cause analysis, it’s suffering. PowerShell read event log commands let you filter, aggregate, and export events programmatically across local and remote systems. This post covers both Get-EventLog for classic logs and Get-WinEvent for modern structured event queries, with working filter examples for the most common diagnostic scenarios.

List Available Event Logs

Before reading events, confirm which logs exist on the machine. Get-EventLog -List shows classic Windows event logs like Application, System, and Security. Get-WinEvent -ListLog * reveals the full set including modern provider-based logs.

# Classic logs
Get-EventLog -List | Select-Object Log, MaximumKilobytes, RecordCount

# Modern logs (includes Application and Services logs)
Get-WinEvent -ListLog * | Where-Object RecordCount -gt 0 | Sort-Object RecordCount -Descending | Select-Object -First 20

Read Application and System Logs

Retrieve recent entries from the Application or System log. Use -Newest to limit the result set — without it you may retrieve tens of thousands of events.

# Last 50 entries from System log
Get-EventLog -LogName System -Newest 50

# Errors and Warnings only from Application log
Get-EventLog -LogName Application -Newest 100 -EntryType Error, Warning |
    Select-Object TimeGenerated, Source, EventID, Message
TimeGenerated       Source          EventID  Message
-------------       ------          -------  -------
5/4/2026 2:15:00 AM Service Control 7034     The Print Spooler service terminated unexpectedly...
5/4/2026 1:08:00 AM MSSQLSERVER     17806    SSPI handshake failed...

Filter by Event ID

Event IDs are the fastest way to find specific event types. Common IDs worth knowing: 4624 (successful logon), 4625 (failed logon), 6006 (clean shutdown), 41 (unexpected restart), 7034 (service crash).

# All failed logon attempts (Security log — requires admin)
Get-EventLog -LogName Security -InstanceId 4625 -Newest 20 |
    Select-Object TimeGenerated, Message

# Service crashes in System log
Get-EventLog -LogName System -InstanceId 7034 -Newest 10

The -InstanceId parameter maps to the Event ID number you see in Event Viewer.

Get-WinEvent for Modern Logs

Get-WinEvent is the modern, more powerful alternative. It supports XPath and hash table filters, accesses logs that Get-EventLog cannot (like Sysmon, PowerShell operational, DNS server logs), and works in PowerShell 7 where Get-EventLog is not available.

# Hash table filter — fastest method
$filterHash = @{
    LogName   = "System"
    Id        = 7034
    StartTime = (Get-Date).AddDays(-7)
}
Get-WinEvent -FilterHashtable $filterHash |
    Select-Object TimeCreated, ProviderName, Id, Message
# PowerShell script block logging (operational log)
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -MaxEvents 20 |
    Select-Object TimeCreated, Id, Message

Read Logs on Remote Computer

Both Get-EventLog and Get-WinEvent support remote queries. For Get-WinEvent on a remote machine, use -ComputerName. WinRM must be enabled on the remote host.

# Read System log on remote server
Get-EventLog -LogName System -ComputerName "server01" -Newest 50 -EntryType Error

# Get-WinEvent on remote machine
Get-WinEvent -ComputerName "server01" -FilterHashtable @{
    LogName   = "Application"
    Level     = 2  # Error
    StartTime = (Get-Date).AddHours(-24)
}

Export Events to CSV

Exporting events to CSV is useful for sharing with a team or loading into Excel for analysis. Select only the columns you need — the raw Message field can be thousands of characters, so truncate it if needed.

$startTime = (Get-Date).AddDays(-1)

Get-WinEvent -FilterHashtable @{ LogName = "System"; StartTime = $startTime } |
    Select-Object TimeCreated, ProviderName, Id,
        @{ N="ShortMessage"; E={ $_.Message.Substring(0, [Math]::Min(200, $_.Message.Length)) } } |
    Export-Csv -Path "C:\Logs\SystemEvents-$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

Write-Output "Events exported."

Common Errors and Fixes

  • Get-EventLog deprecated in PowerShell 7: Get-EventLog is not available in PowerShell 7 — it was removed as part of the cross-platform push. Use Get-WinEvent with a -FilterHashtable instead. The hash table approach is actually faster for large logs because filtering happens at the provider level before data is returned to PowerShell.
  • Access denied on Security log: The Security event log requires administrator privileges. If you receive an “Access is denied” error, run your PowerShell session as administrator, or use a -Credential parameter when querying a remote machine: Get-WinEvent -ComputerName server01 -Credential (Get-Credential) -FilterHashtable @{ LogName="Security" }.

Related Cmdlets / See Also

Wrapping Up

For new scripts, always use Get-WinEvent with a hash table filter — it’s faster, available in PowerShell 7, and handles the full range of Windows event logs. As a next step, combine event log queries with Send-MailMessage (or Graph API) to build a nightly error summary email that gives you a consolidated view of critical events across your server fleet.

#audit#event-log#get-eventlog#windows
Send-Item -To