Tutorial Powershell - Filtering Windows event logs

Would you like to learn how to filter Windows event logs using Powershell? In this tutorial, we are going to show you how to filter event logs using the command line.

• Windows 2012 R2
• Windows 2016
• Windows 2019
• Windows 2022
• Windows 10
• Windows 11

Equipment list

Here you can find the list of equipment used to create this tutorial.

Equipment list

This link will also show the software list used to create this tutorial.

Tutorial Powershell - Filtering Windows event logs

Start an elevated Powershell command line.

List all log files.

Copy to Clipboard

Here is the command output.

Copy to Clipboard

Get a summary of all log files.

Copy to Clipboard

Get a summary of all enabled log files with records greater than 0.

Copy to Clipboard

Here is the command output.

Copy to Clipboard

LogName                                                                        RecordCount IsEnabled IsClassicLog  LogMode        LogType
-------                                                                        ----------- --------- ------------  -------        -------
Windows PowerShell                                                                    1111      True         True Circular Administrative
System                                                                                5465      True         True Circular Administrative
Security                                                                              3950      True         True Circular Administrative
Application                                                                            698      True         True Circular Administrative
Microsoft-Windows-WinINet-Config/ProxyConfigChanged                                      1      True        False Circular    Operational
Microsoft-Windows-WindowsUpdateClient/Operational                                       53      True        False Circular    Operational
Microsoft-Windows-Windows Firewall With Advanced Security/Firewall                     454      True        False Circular    Operational

List all log provider names.

Copy to Clipboard

Here is the command output.

Copy to Clipboard

List the type of events available on a specific log provider.

Copy to Clipboard

List the events of a classic log file.

Copy to Clipboard

List the events of a modern log file.

Copy to Clipboard

Filter events using the log name.

Copy to Clipboard

Filter events using the log name and the event ID.

Copy to Clipboard

Filter events with a specific start date.

Copy to Clipboard

Filter events with a specific start and end date.

Copy to Clipboard

Filter events within a specific time interval.

Copy to Clipboard

There are multiple ways to filter date and time.

Copy to Clipboard

Filter events using the error level.

Copy to Clipboard

Filter events using the message content.

Copy to Clipboard

List all the fields available to filter an event.

Copy to Clipboard

Here is the command output.

Copy to Clipboard

TypeName: System.Diagnostics.Eventing.Reader.EventLogRecord

Name                 MemberType   Definition
----                 ----------   ----------
Dispose              Method       void Dispose(), void IDisposable.Dispose()
Equals               Method       bool Equals(System.Object obj)
FormatDescription    Method       string FormatDescription(), string FormatDescription(System.Collections.Generic.IEnumerable[System.Object] values)
GetHashCode          Method       int GetHashCode()
GetPropertyValues    Method       System.Collections.Generic.IList[System.Object] GetPropertyValues(System.Diagnostics.Eventing.Reader.EventLogPropertySelector propertySelector)
GetType              Method       type GetType()
ToString             Method       string ToString()
ToXml                Method       string ToXml()
Message              NoteProperty string Message=An account failed to log on....
ActivityId           Property     System.Nullable[guid] ActivityId {get;}
Bookmark             Property     System.Diagnostics.Eventing.Reader.EventBookmark Bookmark {get;}
ContainerLog         Property     string ContainerLog {get;}
Id                   Property     int Id {get;}
Keywords             Property     System.Nullable[long] Keywords {get;}
KeywordsDisplayNames Property     System.Collections.Generic.IEnumerable[string] KeywordsDisplayNames {get;}
Level                Property     System.Nullable[byte] Level {get;}
LevelDisplayName     Property     string LevelDisplayName {get;}
LogName              Property     string LogName {get;}
MachineName          Property     string MachineName {get;}
MatchedQueryIds      Property     System.Collections.Generic.IEnumerable[int] MatchedQueryIds {get;}
Opcode               Property     System.Nullable[int16] Opcode {get;}
OpcodeDisplayName    Property     string OpcodeDisplayName {get;}
ProcessId            Property     System.Nullable[int] ProcessId {get;}
Properties           Property     System.Collections.Generic.IList[System.Diagnostics.Eventing.Reader.EventProperty] Properties {get;}
ProviderId           Property     System.Nullable[guid] ProviderId {get;}
ProviderName         Property     string ProviderName {get;}
Qualifiers           Property     System.Nullable[int] Qualifiers {get;}
RecordId             Property     System.Nullable[long] RecordId {get;}
RelatedActivityId    Property     System.Nullable[guid] RelatedActivityId {get;}
Task                 Property     System.Nullable[int] Task {get;}
TaskDisplayName      Property     string TaskDisplayName {get;}
ThreadId             Property     System.Nullable[int] ThreadId {get;}
TimeCreated          Property     System.Nullable[datetime] TimeCreated {get;}
UserId               Property     System.Security.Principal.SecurityIdentifier UserId {get;}
Version              Property     System.Nullable[byte] Version {get;}

Get the name and value of all fields of an event.

Copy to Clipboard

Congratulations! You are able to filter Windows log events using Powershell.

Powershell - Filtering Windows event logs

Powershell - Filtering Windows event logs

Equipment list

Related tutorial - PowerShell

Tutorial Powershell - Filtering Windows event logs

Related Posts