Event log reading in PowerShell

Introduction

Event logs help you see what happened on your computer. Reading them lets you find problems or check important actions.

You want to check why your computer or program stopped working.

You need to see who logged into your computer and when.

You want to monitor if a program is running correctly.

You are troubleshooting errors after installing new software.

You want to keep a record of system warnings or failures.

Syntax

PowerShell

Get-EventLog -LogName <LogName> [-Newest <Number>] [-EntryType <Type>] [-After <DateTime>] [-Before <DateTime>]

-LogName is the name of the event log, like 'System' or 'Application'.

You can filter events by type (Error, Warning, Information) or by date.

Examples

Shows the 5 most recent events from the System log.

PowerShell

Get-EventLog -LogName System -Newest 5

Shows error events from the Application log in the last day.

PowerShell

Get-EventLog -LogName Application -EntryType Error -After (Get-Date).AddDays(-1)

Shows the 10 newest security events, like logins.

PowerShell

Get-EventLog -LogName Security -Newest 10

Sample Program

This script shows the last 3 error events from the System log. It prints the time, source, and message for each event.

PowerShell

Write-Host "Last 3 errors from System log:";
Get-EventLog -LogName System -EntryType Error -Newest 3 | ForEach-Object {
    Write-Host "Time:" $_.TimeGenerated;
    Write-Host "Source:" $_.Source;
    Write-Host "Message:" $_.Message;
    Write-Host "---";
}

Important Notes

You need to run PowerShell as Administrator to read some logs like Security.

Event logs can be large; filtering helps find what you need faster.

Use Get-EventLog -List to see all available logs on your system.

Summary

Event log reading helps find system or application issues.

Use Get-EventLog with filters to get specific events.

Always check the time, source, and message to understand each event.