0

I am trying to list all events that have been logged repeatedly

I tried this earlier:

Get-EventLog -ListLog * |Where-Object {$_.RecordCount -eq 2}

also

Get-WinEvent -ListLog * |Where-Object {$_.RecordCount -eq 2}

Both are not working

1
  • 1
    Get-EventLog doesn't have a parameter -ListLog, and Get-WinEvent -ListLog * will give you a list of all logs where RecordCount holds the total number of records in each log. Are you looking for consecutive messages or just for messages that have occurred before (at whatever point in time)? Jan 11, 2018 at 13:48

1 Answer 1

2

First, I don't understand what logs do you need use. I wrote this:

Get-WinEvent -LogName System  | Group-Object Message | Sort-Object Count -Descending | Where-Object {$_.Count -gt 2}| ForEach-Object {
    [PSCustomObject]@{
        NumberOfEvents  = $_.Count
        EventId         = $_.Group[0].Id
        Message         = $_.Name
  }
}

For check the System logs. The result is like:

NumberOfEvents EventId Message                                                                                                                                                       
-------------- ------- -------                                                                                                                                                       
            12      44 Windows Update started downloading an update.                                                                                                                 
             8   10016 The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID ...                           
             8      24 NIC /DEVICE/{2FC7C3F4-BBB9-448E-92DB-A1761FDF2718} (Friendly Name: Microsoft Network Adapter Multiplexor Driver) is no longer operational.                    
             7     158 The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is e...
             7    7040 The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start.                                            
             7    7001 Cannot retrieve event message text.                                                                                                                           
             7    7040 The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start.                                            
             6     521 Active battery count change.                                                                                                                                  
             5     105 Power source change.                                                                                                                                          

Cheers,

Victor

3
  • Message is logname but where is Application log but I tried this Get-WinEvent -ListLog * |Where-Object {$_.RecordCount -gt 1} I got Logname and matched from event viewer but I am getting admin and firewall problem also. When I tried your code Message==Name I am not getting what I retrieved
    – Kramer
    Jan 11, 2018 at 14:12
  • can we display from all log? since you asked from what log do you need to use? instead of System log
    – Kramer
    Jan 11, 2018 at 14:17
  • Like this: foreach ($item in (Get-WinEvent -ListLog * -EA silentlycontinue | Where-Object {$_.RecordCount -gt 0}) ) { $category = $item.LogName Write-host "###" $category "###" Get-WinEvent -LogName $category | Group-Object Message | Select Count,@{Name="Id";Expression={($_.Group[0].Id)}},Name | Sort-Object Count -Descending | Where-Object {$_.Count -gt 1} | ft } Jan 11, 2018 at 16:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.