PowerShell utility function to find EventLog errors.

readme.md

Usage

#Search for All Event Log(Require Administrator previlage)
Get-EventLogError -FilterLevel Warning -FromLastBootupTime  | Format-Table -AutoSize

#Search for Windows PowerShell Logs
Get-EventLogError -LogName "*PowerShell*" -FilterLevel Warning -FromLastBootupTime | Format-Table -AutoSize

#Search for Application/System Log
Get-EventLogError -LogName @("Application","System") -FilterLevel Warning -FromLastBootupTime | Format-Table -AutoSize

#Specify Range
$from = (Get-Date).AddHours(-20)
$to   = (Get-Date)
Get-EventLogError -LogName @("Application","System") -FilterLevel Warning -From $from -To $to | Format-Table -AutoSize

#Add new entry to EventLog
Write-EventLog -LogName Application -Source Application -Message "Test" -EventId 0 -EntryType information

#Get EventLog entry added after last query execution
Get-EventLogError -LogName "Application" -FilterLevel Infomational -FromLastQueryTime | Format-Table -AutoSize

Get-EventLogError.ps1

function Get-EventLogError
{
[CmdletBinding()]
param(
[Parameter(Mandatory,ParameterSetName="FromLastBootupTime")]
[switch] $FromLastBootupTime,
[Parameter(Mandatory,ParameterSetName="FromLastQueryTime")]
[switch] $FromLastQueryTime,
[Parameter(Mandatory,ParameterSetName="Range")]
[DateTime] $From,
[DateTime] $To,
[ValidateSet("Verbose","Infomational","Warning","Error","Critical")]
[string] $FilterLevel = "Warning",
[string[]] $LogName = "*"
)   
    #Set current time to temporary variable
    $now  = [DateTime]::Now

    #Set query StartTime
    switch($PsCmdlet.ParameterSetName)
	{
		"FromLastBootupTime"{
			$From = (Get-CimInstance win32_Operatingsystem).LastBootupTime
		}
		"FromLastQueryTime"{
            #Get $script:LastQueryTime variable
		    $variable = Get-Variable -Scope Script -Name "LastQueryTime" -ErrorAction Ignore
            if($variable -ne $null){
                $From = ([DateTime]$variable.Value)
            }
            else{
                $From = (Get-CimInstance win32_Operatingsystem).LastBootupTime  #Use LastBootup time for initial value 
            }
		}
	}

    #Set Event Filter
    switch($FilterLevel)
    {
        "Verbose"     {$Level= @(1,2,3,4,5)}
        "Infomational"{$Level= @(1,2,3,4)}
        "Warning"     {$Level= @(1,2,3)}
        "Error"       {$Level= @(1,2)}
        "Critical"    {$Level= @(1)}
    }

    #Resolve log names
    [string[]] $LogNames = Get-WinEvent -ListLog $LogName | where RecordCount -gt 0 | select -ExpandProperty LogName
    if($LogName -eq $null){
        throw ("LogName({0} is not found!)" -f $LogName)
    }

    #Execute query
    $filter = @{
		Level     = $Level
		LogName   = $LogNames
		StartTime = $From
	}
    if(![String]::IsNullOrEmpty($To)){
        $filter.EndTime = $To    #Set EndTime
    }
	$results = Get-WinEvent -FilterHashtable $filter -ErrorAction Ignore `
                          | select ProviderName,Level,Id,Message,LogName,LevelDisplayName,TimeCreated,Category `
                          | sort TimeCreated

    #Update LastQueryTime
    $script:LastQueryTime = $now #.AddSeconds(1)
    
    #Return EventLogs
    return $results
}