I am trying to list all events that have been logged repeatedly
I tried this earlier:
Get-EventLog -ListLog * |Where-Object {$_.RecordCount -eq 2}
also
Get-WinEvent -ListLog * |Where-Object {$_.RecordCount -eq 2}
Both are not working
First, I don't understand what logs do you need use. I wrote this:
Get-WinEvent -LogName System | Group-Object Message | Sort-Object Count -Descending | Where-Object {$_.Count -gt 2}| ForEach-Object {
[PSCustomObject]@{
NumberOfEvents = $_.Count
EventId = $_.Group[0].Id
Message = $_.Name
}
}
For check the System logs. The result is like:
NumberOfEvents EventId Message
-------------- ------- -------
12 44 Windows Update started downloading an update.
8 10016 The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID ...
8 24 NIC /DEVICE/{2FC7C3F4-BBB9-448E-92DB-A1761FDF2718} (Friendly Name: Microsoft Network Adapter Multiplexor Driver) is no longer operational.
7 158 The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is e...
7 7040 The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start.
7 7001 Cannot retrieve event message text.
7 7040 The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start.
6 521 Active battery count change.
5 105 Power source change.
Cheers,
Victor
Get-EventLog
doesn't have a parameter-ListLog
, andGet-WinEvent -ListLog *
will give you a list of all logs whereRecordCount
holds the total number of records in each log. Are you looking for consecutive messages or just for messages that have occurred before (at whatever point in time)?