Powershell Get-WinEvent strangeness

Question

_{Wednesday, December 5, 2018 3:58 AM}

I usually avoid posting multiple issues, but these are so closely related that to not post everything I've experienced would be silly.

=====

ISSUE #1: When run in Powershell,

PS D:\> Get-WinEvent > Get-WinEvent.txt

does not redirect (i.e., Get-WinEvent.txt is zero-byte), and the screen overflows so that only the last few hundred output lines are shown.

=====

ISSUE #2: When run outside Powershell,

D:\>powershell Get-WinEvent > Get-WinEvent.txt

does redirect (Get-WinEvent.txt = 1234027 bytes).

=====

ISSUE #3: Here is the content of Get-WinEvent.txt:

Get-WinEvent : The data is invalid
At line:1 char:1
+ Get-WinEvent
+ ~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-WinEvent], EventLogInvalidDataException
    + FullyQualifiedErrorId : The data is invalid,Microsoft.PowerShell.Commands.GetWinEventCommand
...4468 more occurances of the above section, plus this last section:
Get-WinEvent : No events were found that match the specified selection criteria.
At line:1 char:1
+ Get-WinEvent
+ ~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (:) [Get-WinEvent], Exception
    + FullyQualifiedErrorId : NoMatchingEventsFound,Microsoft.PowerShell.Commands.GetWinEventCommand

=====

QUESTION #1: Why the Powershell redirection problem (ISSUE #1)?

QUESTION #2: Why the Get-WinEvent problem (ISSUE #3)?

All replies (8)

_{Wednesday, December 5, 2018 9:41 AM ✅Answered}

Hi,

 Thanks for your reply.

Sorry. "-ListLog" parameter only can get log list. 

 Get-WinEvent -ListLog * | ForEach-Object {Get-WinEvent -LogName $_.logname} 

"Get-WinEvent -ListLog *" get log list, then use their log names properties to get all the log entries.

Best Regards,

Lee

Just do it.

_{Wednesday, December 5, 2018 5:11 AM}

You are mixing Dos syntax with Powershell syntax.

To write to a file: use Out-File.

But you should ask this sort of questions in the scripting forum.

_{Wednesday, December 5, 2018 7:27 AM}

Hi,

Thanks for your question.

Get-WinEvent -ListLog * | Out-File -FilePath filepath

When you use "Get-WinEvent" cmdlet, you need to add some required parameters. Just like my example, it can give you all the localhost's logs. Also, you can use other parameters to solve your issue. Please refer the link below to learn something about the cmdlet.

/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-6

I agree with EckiS. You need to use out-file cmdlet, and add the txt file path after the -filepath parameter.

Best Regards,

Lee

Just do it.

_{Wednesday, December 5, 2018 7:42 AM}

@Lee

I did get output for

PS D:\Get-WinEvent

Get-WinEvent : The data is invalid
At line:1 char:1
+ Get-WinEvent
+ ~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-WinEvent], EventLogInvalidDataException
    + FullyQualifiedErrorId : The data is invalid,Microsoft.PowerShell.Commands.GetWinEventCommand
...4468 more occurances of the above section, plus this last section:
Get-WinEvent : No events were found that match the specified selection criteria.
At line:1 char:1
+ Get-WinEvent
+ ~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (:) [Get-WinEvent], Exception
    + FullyQualifiedErrorId : NoMatchingEventsFound,Microsoft.PowerShell.Commands.GetWinEventCommand

Do you have any idea why I get nothing but errors?

PS: Yes, I recognized Get-WinEvent as a Powershell command, and I read the Get-WinEvent documentation before I submitted it on the command line. The documentation says that if run with no arguments, Get-WinEvent gets all events. That's what I want.

_{Wednesday, December 5, 2018 8:28 AM}

Hi,

I think if you use "Get-EventLog" cmdlet, you don't need to add other parameters.

Get-WinEvent -ListLog *

It can get output.

Best Regards,

Lee

Just do it.

_{Wednesday, December 5, 2018 9:01 AM}

Get-WinEvent -ListLog *

Lee, the cmd line above only gets the log list, not the logs. No argument is supposed to get all the log entries (tens of thousands), but it just gets me error messages. Why?

PS: Kindly try it yourself and see if

PS > Get-WinEvent

works for you.

_{Thursday, December 6, 2018 9:50 AM}

Hi,

I have tried it. It also doesn't work for me. Also, I found it doesn't work after the windows server 2008. In Windows Server 2008, it can work fine.

But I think you can get all the event entries by the script below.

Get-WinEvent -ListLog * | ForEach-Object {Get-WinEvent -LogName $_.logname} |fl

Best Regards,

Lee

Just do it.

_{Thursday, December 6, 2018 8:49 PM}

I have tried it. It also doesn't work for me.

Per your earlier suggestion, I ran this:

Get-WinEvent -ListLog * | ForEach-Object {Get-WinEvent -LogName $_.logname} | Out-File -FilePath Get-WinEvent.txt

It worked fine -- 79.1MB of text! :-)

Thanks so much for your help.