Get-EventLog
Use Get-EventLog to read the System, Application, and Security logs — filter by newest entries, entry type, source, or date.
Documentation: Microsoft Learn — get-eventlog
Syntax
Try it
PowerShell example · browser support is limited.
Execution scope: The full example below requires PowerShell outside this browser. You can edit this runner to use the supported practice commands; unsupported syntax returns an explanation.
Examples
Show the 20 newest System log entries
Show reference output
Illustrative output · values vary by environment
Index Time EntryType Source InstanceID Message ----- ---- --------- ------ ---------- ------- 48211 Oct 24 18:02 Error Service Control Manager 7036 The Windows Update service entered the stopped state.
Show only errors from the last day
Show reference output
Illustrative output · values vary by environment
Index Time EntryType Source InstanceID Message ----- ---- --------- ------ ---------- ------- 48201 Oct 24 11:47 Error Disk 11 The driver detected a controller error.
Find events from one source
Show reference output
Illustrative output · values vary by environment
Index Time EntryType Source InstanceID Message ----- ---- --------- ------ ---------- ------- 12904 Oct 24 09:15 Warning MyApp 2001 Retry limit reached for job 482.
Parameters
Parameter definitions:
-LogName— Which log to read: System, Application, Security, or a custom log name.-Newest— Returns only the newest N entries. Always use this on busy logs.-After / -Before— Date range filter. Combine with -Newest for fast, narrow queries.-EntryType— Filters by Error, Warning, Information, SuccessAudit, or FailureAudit.-Source— Filters by the application or component that wrote the event.-InstanceId— Filters by event ID number.-ComputerName— Reads the log from a remote computer. Needs remoting and permissions.
Get-EventLog is legacy — Get-WinEvent is the future
Get-EventLog exists only in Windows PowerShell 5.1. It was removed from PowerShell 7, where Get-WinEvent is the replacement. Any new script you write today should use Get-WinEvent, which is faster, works remotely, and can read modern logs that Get-EventLog cannot.
Never run Get-EventLog -LogName System without -Newest on a production server. The System log can hold tens of thousands of entries, and reading all of them into memory is slow and wasteful. Filter first, then read.
The Security log needs administrator rights and, on domain controllers, the right audit policies enabled. An empty result usually means permissions or auditing, not a quiet system.
Read logs the modern way with Get-WinEvent
Build date filters with Get-Date
Updated 25 October 2026. Browser outputs are fictional; check the installed module help for your environment.
Recap
Get-EventLog Use Get-EventLog to read the System, Application, and Security logs — filter by newest entries, entry type, source, or date.
Next: Get Windowsfeature