So let's go back into our environment,
and we'll first look at how we retrieve and query event logs.
And then lastly, we'll export the current event log.
Now one of the most common things that you'll often do is to retrieve event log
information or query the logs for specific types of things.
So there are a couple of commands that we can utilize.
The first one is Get‑EventLog, which is a command.
Now you'll notice in PowerShell 7, when I execute this, it fails.
So let me go here and type PowerShell,
and I'll use the Windows PowerShell option.
Let's just launch that here.
And then I'll say Get‑EventLog, and this time it works.
So there's a difference between the supportability of the two commands.
Get‑EventLog is going to be pre‑PowerShell 7,
whereas the other one, Get‑WinEvent,
is going to be obviously in the newer version.
But what you can see, it's going to ask me for the name,
so I'm going to say system.
And I'll stop that scrolling,
but that's all that the system commands inside the log.
If I go back to PowerShell 7 here and say Get‑WinEvent,
I can press Enter here, it comes back and says whoa,
whoa, whoa!
There's too much information that you're trying to bring back.
So we obviously have specific properties that we can utilize.
So I'm going to say system and stop that scrolling because it goes too fast,
but you'll see it groups all this information together,
and you can see it scrolling on the screen.
So, a fairly straightforward way of retrieving specific values.
Now of course, if we wanted to only bring specific things in,
then we would utilize, if we're using Windows PowerShell 7,
so we would use Get‑WinEvent,
and then what we can do is create a FilterHashtable,
which effectively is a list of properties or key‑value pairs.
So the first thing here is I'm going to say LogName,
because obviously I want to specify the log name.
And what we'll do here is we'll do the Application log
and we can do the System log as well.
So we can do multiple at the same time, so Application and System.
I can then determine the levels that I wish to bring back.
When we talk about the levels,
that will be the types of events that we're trying to bring back.
And then maybe I want to set a start time.
So, let's say I wanted to say get the current date,
and maybe I want to add some hours, basically taking some off,
do Enter.
And then that creates me a query that filters everything to note time and date,
12 hours previous, and only for those types of events,
which would be 2 and 3, which are going to be Warning,
as you can see here,
is coming through and anything that would be kind of critical.
So depending on the level that you choose will determine what gets returned.
But it's really quick and easy to retrieve values from
the event log using that format.
Now of course,
you can always do it the other way by just looping through the properties.
So you can see Credentials, FilterXPath, Force.
So how does that work when we want to do it remotely?
What we can do here is you could specify a ComputerName if needed.
So I could say 192.168.127.128,
and then I could say Credential and do cred and press Enter.
Now what this will do is depending on the session that's been created,
you will be able to connect to that machine,
pass in those credentials, and then it will retrieve any values that come back.
The other approach, which is a cleaner option,
is to actually create the PowerShell session first and then go and
execute the commands in the context of that one there.
Now of course mine tells me the RPC server is unavailable.
That's perfectly fine.
If you look, I still have a session available.
So if my connection isn't working, I can go in and say Enter‑PSSession,
access the session, like so, and then I can say Get‑WinEvent,
let's say system, and Enter.
And those are all the values from the other machine,
the other server, the other client.
Or Windows or Linux or even macOS we can retrieve those same kind of values.
I'm just going to exit that PSSession, like so.
Now of course, that's obviously fairly straightforward,
but obviously in the grand scheme of things you often want
to connect to multiple servers or you want to filter
specific types of information,
and that can be done very simply either in PowerShell
7 or in the Windows PowerShell.
It really depends.
It's your choice.
If we go to the blue option here, which is the Windows PowerShell,
I'm just going to clear this for a second,
we can then use the previous version of the command,
so I can say Get‑EventLog, I'm going to say system.
And then you'll see I've got various options,
so I could say After a specific date, Before,
UserName, InstanceId, etc.
Or what I could do is just say go to the system log and then I can use
standard PowerShell commands to filter the values.
So I could say $_.EntryType.
I could say match an Error.
So that would give me a list of all the error options that were available.
Now of course I could change that and say Warning,
and that would give me all the warning ones.
And you get the point.
We can obviously change.
Now, obviously in Get‑WinEvent I was using the level numbers,
but here, in the original one, in Windows PowerShell,
I can use the names.
So it's a very simple process to be able to get information out
of the Windows event logs simply by just running standard queries
using Get‑WinEvent in PowerShell 7, passing in what you're looking for,
and then being able to query those specific properties.
Now one of the last things that we might want to do after querying
everything is actually export those values out.
So if we go back to our Get‑WinEvent, let's use the properties,
so LogName system, and then we can say Select‑Object.
I'm just going to do * here because I basically want to
bring back every property that's there.
From here I can then pipe that value again,
say Export‑Csv, and then at this point I can just generate a specific file.
So I can say ExportedEvents.csv, like so.
So now this will go ahead and output that.
So you can see I'm in C:\Users\Trainer.
So if I launch here C:, Users, Trainer, you'll see there's an exported CSV.
If I click Edit,
you can see all of my values have now been dropped directly into that file.
So we can very simply export anything by combining that.
If I wanted to have specific headers and columns,
then I would reconstruct the Select‑Object to get the right values and
then put extra properties here on the export to.
But that's as easy as it is to get the values out and dumped down to a CSV file,
for example.