PowerTip: Use PowerShell to Find Event Logs with Events

Summary: Use Windows PowerShell to find all event logs that contain events.

Hey, Scripting Guy! Question How can I use Windows PowerShell to find all traditional and non-traditional event logs that contain events?

Hey, Scripting Guy! Answer Use the Get-WinEvent cmdlet to return all event logs, use Where-Object to filter the logs that
         contain more than 0 records, and sort the results:

In Windows PowerShell 4.0 and Windows PowerShell 3.0:

Get-WinEvent -ListLog * | where recordcount -gt 0 | sort recordcount

In Windows PowerShell 2.0:

Get-WinEvent -ListLog * | where {$_.recordcount -gt 0} | sort recordcount

Comments (5)

  1. jrv says:

    @Ed – I try to get people to change the way they think.  OOP and PowerShell/Net require a huge paradigm shift.  The little things get us into that frame of reference little-by-little.  Once our thinking shifts then we see everything in a completely new way.

  2. jrv says:

    Get-WinEvent -ListLog *  | where {$_.recordcount} | sort recordcount

    Get-WinEvent -ListLog *  | where      recordcount  | sort recordcount

    -eq not needed.

  3. Glenn Wilson says:

    Nice, Thanks for this one.

  4. ed wilson says:

    @JRV you are right. thanks.

  5. ed wilson says:

    @Glenn Wilson you are welcome.

Skip to main content