Problem
You want to store the information in an event log in a file for storage or later review.
Solution
To store event log entries in a file, use the GetEventLog cmdlet to retrieve the entries in the event log, and then pipe them to the ExportCliXml cmdlet to store them in a file.
GetEventLog System | ExportCliXml c:\temp\SystemLogBackup.clixml
Discussion
Once you’ve exported the events from an event log, you can archive them, or use the ImportCliXml cmdlet to review them on any machine that has PowerShell installed:
PS >$archivedLogs = ImportCliXml c:\temp\SystemLogBackup.clixml
PS >$archivedLogs | Group Source
Count Name
Group
856 Service Control Manager
{LEEDESK, LEEDESK, LEEDESK, LEEDESK...
640 TermServDevices
{LEEDESK, LEEDESK, LEEDESK, LEEDESK...
91 Print
{LEEDESK, LEEDESK, LEEDESK, LEEDESK...
100 WMPNetworkSvc
{LEEDESK, LEEDESK, LEEDESK, LEEDESK...
123 Tcpip
{LEEDESK, LEEDESK, LEEDESK, LEEDESK...
(...)
For more information about the GetEventLog cmdlet, type GetHelp GetEventLog. For more information about the ExportCliXml and ImportCliXml cmdlets, type GetHelp ExportCliXml and GetHelp ImportCliXml, respectively.
