Skip to content

Instantly share code, notes, and snippets.

@iyevhen

iyevhen/pull-win-events-for-last-hour.ps1

Created April 9, 2021 11:14
Download ZIP

Revisions

  1. iyevhen created this gist Apr 9, 2021.
    13 changes: 13 additions & 0 deletions pull-win-events-for-last-hour.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,13 @@
    $old = (Get-Date).AddHours(-1)
    $before_lines = 50
    $after_lines = 50

    Write-Host "Pulling Warn/Error Windows Events started >= $old"

    Get-WinEvent -ListLog * -EA silentlycontinue |
    Where-Object { $_.recordcount -AND $_.lastwritetime -gt $old } |
    ForEach-Object { get-winevent -FilterHashtable @{LogName=$_.logname; StartTime=$old } -EA silentlycontinue } |
    Sort-Object TimeCreated |
    Format-List TimeCreated, LevelDisplayName, ProviderName, Message |
    Out-String -Stream -Width 1000 |
    Select-String -Pattern 'LevelDisplayName\s+:\s+Error.*','LevelDisplayName\s+:\s+Warning.*' -Context $before_lines,$after_lines