Problem
You want to retrieve all event log entries that contain a given term.
Solution
To find specific event log entries, use the GetEventLog cmdlet to retrieve the items, and then pipe them to the WhereObject cmdlet to filter them, as shown in Example 202.
Example 202. Searching the event log for entries that mention the term “disk”
PS >GetEventLog System | WhereObject { $_.Message match "disk" }
Index Time Type Source EventID Message
2920 May 06 09:18 Info Service Control M... 7036 The Logical Disk... 2919 May 06 09:17 Info Service Control M... 7036 The Logical Disk... 2918 May 06 09:17 Info Service Control M... 7035 The Logical Disk... 2884 May 06 00:28 Erro sr 1 The System Resto... 2333 Apr 03 00:16 Erro Disk 11 The driver detec... 2332 Apr 03 00:16 Erro Disk 11 The driver detec... 2131 Mar 27 13:59 Info Service Control M... 7036 The Logical Disk... 2127 Mar 27 12:48 Info Service Control M... 7036 The Logical Disk... 2126 Mar 27 12:48 Info Service Control M... 7035 The Logical Disk... 2123 Mar 27 12:31 Info Service Control M... 7036 The Logical Disk... 2122 Mar 27 12:29 Info Service Control M... 7036 The Logical Disk... 2121 Mar 27 12:29 Info Service Control M... 7035 The Logical Disk...
Discussion
Since the GetEventLog cmdlet retrieves rich objects that represent event log entries, you can pipe them to the WhereObject cmdlet for equally rich filtering.
By default, PowerShell’s default table formatting displays a summary of event log entries. If you are searching the event log message, however, you are probably interested in seeing more details about the message itself. In this case, use the FormatList cmdlet to format these entries in a more detailed list view. Example 203 shows this view.
Example 203. A detailed list view of an event log entry
PS >GetEventLog System | WhereObject { $_.Message match "disk" } | >> FormatList >>
Index
: 2920
EntryType
: Information
EventID
: 7036
Message
: The Logical Disk Manager Administrative Service servi
ce entered the stopped state.
Category
: (0)
CategoryNumber
: 0
ReplacementStrings : {Logical Disk Manager Administrative Service, stopped
} Source : Service Control Manager TimeGenerated : 5/6/2007 9:18:25 AM TimeWritten : 5/6/2007 9:18:25 AM UserName :
Index : 2919 (...)
For more information about the GetEventLog cmdlet, type GetHelp GetEventLog.
