This post appeared originally in our sysadvent series and has been moved here following the discontinuation of the sysadvent microsite

Read logs in PowerShell console.

It’s easy to get lost in Windows large event logs and log files during troubleshooting, here to help are PowerShell cmdlets Get-EventLog and Get-Content.

These cmdlets shows PowerShell’s strength comparing to the built-in GUI-tools in Windows. Let’s start with cmdlet Get-EventLog to get some information from an event log. Examples below is how I often work with these cmdlets when searching for logged events on hosts.

Start PowerShell from a command prompt by typing powershell.exe or enter powershell.exe in run command window.

View five newest events that been logged and display output as an list with fl/format-list.

Get-Eventlog -Logname System -Newest 5 | fl

View only error and warning events, use parameter “EntryType”.

Get-EventLog -LogName System -Newest 10 -EntryType Error,Warning | fl

EventID can be useful information to have, to get it we need to select the objects we want to view from an event. Has also changed search area to after an entered date.

Get-EventLog -LogName System -After 2016-11-24 -EntryType Error,Warning | select-object TimeWritten,EntryType,Source,EventID,Username,Message | fl
The event log
The event log

To find events that have equal values, you can use ‘Where-Object’. Results will only display if Event ID is 10016 and EntryType equals error.

Get-EventLog -LogName System -After 2016-11-24 | Where-Object {$_.EventId -eq 10016 -and $_.EntryType -eq 'Error'} | fl

Do this remotely to an host is comfortable when you switching between different ones, use parameter ‘ComputerName’. You can enter multiple hosts or create arrays.

Get-EventLog -ComputerName host1.web.com -LogName System -Newest 50 | Where-Object {$_.EventId -eq 10016 -and $_.EntryType -eq 'Error'} | fl

Let’s filter out this even more by using time ranges when searching for events,this is perfect to use when have you large quantities during a day. The event we are looking for is between 11:00 to 11:30 on specified day.

Get-EventLog -LogName System -After ([datetime]'2016-12-08 11:00') -before ([datetime]'2016-12-08 11:30')

OK, but there’s still a lot of events I don’t want read through. An option is to match a value to what the event message contains, I’m not viewing output with fl/format-list this time.

Get-EventLog -LogName System -After ([datetime]'2016-11-24 11:00') -before ([datetime]'2016-11-24 11:30') | Where-Object {$_.message -match "service entered the stopped state"}
Matching a message
Matching a message

Working with log files

Large log files can be really annoying to handle if you only have an basic text editor available. PowerShell’s cmdlet Get-Content can relive some pain for you when working with thousands of lines.

To not get entire content of an file in console window, select only last 10 rows from the end.

Get-Content .\IISwebsite.log -tail 10
Tail
Tail

Depending on log files structure it still can be a mess for your eyes to read it in console window, send your output with ‘Out-Gridview’ to view it in a grid window.

Get-Content .\IISwebsite.log -first 15 | Out-Gridview
Gridview
Gridview

Pick up strings in log files is also useful. Select all strings containing “HttpError”.

Get-Content .\IISwebsite.log | ? {($_ | Select-String “HttpError”)}

When located logged information and want to export selected strings to a new file.

Get-Content .\IISwebsite.log | ? {($_ | Select-String “HttpError”)} | Out-file 'path\file.log'

Containerized Development Environment

Do you spend days or weeks setting up your development environment just the way you like it when you get a new computer? Is your home directory a mess of dotfiles and metadata that you’re reluctant to clean up just in case they do something useful? Do you avoid trying new versions of software because of the effort to roll back software and settings if the new version doesn’t work?

Take control over your local development environment with containerization and Dev-Env-as-Code!

... [continue reading]

Ansible-runner

Published on February 27, 2024

Portable Java shell scripts with Java 21

Published on February 21, 2024