PowerShell Event logs

Filtering is the whole skill. Get-WinEvent -LogName System | Where-Object Id -eq 7001 reads the entire log into PowerShell and then discards almost all of it, which on a busy server takes minutes. -FilterHashtable pushes the filter into the log service, so only matching records are ever returned:

Get-WinEvent -FilterHashtable @{ LogName='System';Id=7001;StartTime=(Get-Date).AddDays(-1) }

The keys you will use are LogName, ProviderName, Id, Level, StartTime and EndTime. The speed difference is not marginal; it is the difference between a usable query and one you cancel.

Message text is expensive to render and locale-dependent, so filter on Id and ProviderName rather than searching Message. -MaxEvents caps the result, and it applies after filtering, so combine it with -FilterHashtable rather than using it alone.

Remote logs work with -ComputerName, and require the Remote Event Log Management firewall rule rather than WinRM.

This reads five records from the System log. -MaxEvents keeps it fast here, but on a real investigation you would add -FilterHashtable so the log service does the filtering. LevelDisplayName gives you the readable severity, where the raw Level property is a number.

• Get-WinEvent replaces Get-EventLog, which is gone in PowerShell 7.
• -FilterHashtable filters in the log service. Where-Object does not.
• Filter on Id and ProviderName, not on Message text.
• Remote reads need the Remote Event Log Management rule.

Select-Object reference · Get-WinEvent reference