How to export event viewer to a log file using PowerShell

Home > Search > How-to
  by

The get-eventlog cmdlet can be used to view the Event Log in PowerShell. For example, to view every record in the Security log:

$computername = $env:computername
Get-EventLog -ComputerName $computername -log "Security"

 

This command will produce a list of events.

   Index Time          EntryType   Source                 InstanceID Message                                                                                                                                                      
   ----- ----          ---------   ------                 ---------- -------                                                                                                                                                      
  695920 Mar 20 10:04  FailureA... Microsoft-Windows...         4673 A privileged service was called....                                                                                                                          
  695919 Mar 20 10:03  FailureA... Microsoft-Windows...         4673 A privileged service was called....                                                                                                                          
  695918 Mar 20 10:03  FailureA... Microsoft-Windows...         4673 A privileged service was called....                                                                                                                          
  695917 Mar 20 10:03  SuccessA... Microsoft-Windows...         4688 A new process has been created....                                                                                                                           
  695916 Mar 20 10:03  SuccessA... Microsoft-Windows...         4688 A new process has been created....  

 

To view the entire event, add Format-List -Property *. This will produce verbose output.

$computername = $env:computername
Get-EventLog -ComputerName $computername -log "Security" | Format-List -Property *

 

The output can be redirected to a file.

$computername = $env:computername

$application_log = get-eventlog -ComputerName $computername -log "Application" | Format-List -Property *

$application_log >> C:\temp\event.log

 



Add a Comment




We will never share your name or email with anyone. Enter your email if you would like to be notified when we respond to your comment.




Please enter in the box below so that we can be sure you are a human.




Comments