Get-WinEvent

SafeQuery event logs (modern)

Get-WinEvent -LogName System -MaxEvents 50

The current event-log query cmdlet. Get-EventLog was removed in PowerShell 7, so use this. FilterHashtable filtering by ID and time is dramatically faster.

Examples

Get-WinEvent -FilterHashtable @{LogName='System';Id=6008} -MaxEvents 10Unexpected shutdown events
Get-WinEvent -LogName System -MaxEvents 50Last 50 system events

Syntax

Get-WinEvent [-LogName name] [-FilterHashtable @{...}]

Before you run it

Read only.

Related commands

wevtutilEvent logs from the CLI
journalctlsystemd logs

The same reference, with no signal at all

Every command on this site, held on your device. The app adds 632 more: 1,510 commands and 120 fix flows, searchable with no connection. Free to install, no ads (some content is a one-time purchase).

Get it free on the App Store