How to Get Event Log in PowerShell: Simple Commands

Use the Get-EventLog cmdlet in PowerShell to retrieve event logs from your system. For example, Get-EventLog -LogName Application fetches entries from the Application log.

Syntax

The basic syntax to get event logs in PowerShell is:

• Get-EventLog -LogName <LogName>: Retrieves events from the specified log.
• -Newest <Number>: Limits the output to the most recent events.
• -EntryType <Type>: Filters events by type like Error, Warning, or Information.

powershell

Get-EventLog -LogName Application -Newest 10 -EntryType Error

Example

This example shows how to get the 5 most recent error events from the System log.

powershell

Get-EventLog -LogName System -EntryType Error -Newest 5 | Format-Table TimeGenerated, Source, EventID, Message -AutoSize

Output

TimeGenerated          Source                  EventID Message
-------------          ------                  ------- -------
4/26/2024 10:15:23 AM  Service Control Manager  7000    The service failed to start.
4/26/2024 9:50:11 AM   Disk                    7       The device, \\.\PHYSICALDRIVE0, has a bad block.
4/25/2024 8:30:45 PM   Tcpip                   4226    TCP/IP has reached the security limit.
4/25/2024 7:15:00 PM   Service Control Manager  7009    Timeout waiting for service.
4/25/2024 6:45:12 PM   Application Error       1000    Faulting application name: example.exe

Common Pitfalls

Common mistakes when getting event logs include:

• Using incorrect log names like ApplicationLog instead of Application.
• Not running PowerShell as Administrator, which may limit access to some logs.
• Expecting Get-EventLog to work with newer Windows event logs like Microsoft-Windows-* which require Get-WinEvent.

powershell

## Wrong: Incorrect log name
Get-EventLog -LogName ApplicationLog

## Right: Correct log name
Get-EventLog -LogName Application

Quick Reference

Parameter	Description
-LogName	Name of the event log (e.g., Application, System, Security)
-Newest	Number of latest events to retrieve
-EntryType	Filter by event type: Error, Warning, Information
-Source	Filter events by source application or service
-After	Get events after a specific date/time
-Before	Get events before a specific date/time

Key Takeaways

Use Get-EventLog with the correct log name to retrieve Windows event logs.

Run PowerShell as Administrator to access all event logs.

Use parameters like -Newest and -EntryType to filter results.

For newer event logs, consider using Get-WinEvent instead.

Always verify log names to avoid errors.