Monday, December 11, 2017

Searching all event logs with PowerShell

For this Super User answer, I needed to search all event logs - not just the five standard ones under Windows Logs - for a bit of text. PowerShell's Get-WinEvent does the job:
Get-WinEvent -ListLog * | ? { $_.RecordCount -gt 0 } | % { Get-WinEvent -LogName $_.LogName -MaxEvents 100 } | ? { $_.ToXml().Contains('text') }

If you need to look at events far in the past, you can adjust the -MaxEvents 100 or remove it entirely; the process will just take a while.

No comments:

Post a Comment