However, keep in mind that
this command lists every event in the log, which is probably not what you really want to do. For a log
containing hundreds and maybe even thousands of entries, you would find it next to impossible to use.
Instead, add the Newest parameter followed by an integer value to limit the output to the number
specified. For example, to display the five newest events from the Application Event Log, use the
following command:
[PS] C:\ > Get-EventLog -LogName Application -Newest 5
Index Time Type Source EventID Message
----- ---- ---- ------ ------- -------
2513 Aug 04 18:00 Info MSExchange ADAccess 2080 Process MSEXCHANGEADT...
2512 Aug 04 17:45 Info MSExchange ADAccess 2080 Process MSEXCHANGEADT...
2511 Aug 04 17:30 Info MSExchange ADAccess 2080 Process MSEXCHANGEADT...
2510 Aug 04 17:15 Info MSExchange ADAccess 2080 Process MSEXCHANGEADT...
2509 Aug 04 17:00 Info MSExchange ADAccess 2080 Process MSEXCHANGEADT...
In this example the last five events generated are displayed in order from latest to earliest. The output
includes the time stamp for when the event was generated, the event type, the event source, the
event ID, and the message (truncated). To see the complete event message, pipe the results to
Format-Table or Format-List . You may find that using Format-List presents a more
comprehensive output than Format-Table does.
Pages:
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119