none
List eventlog sources?

    質問

  • Hi!

    Just started playing around with the eventlog and powershell and i can't figure out how to list sources of a eventlog. I can see if a source exists and where it exist:

    [System.Diagnostics.EventLog]::SourceExists("Sourename")
    
    [System.Diagnostics.EventLog]::LogNameFromSourceName("Sourcename",".")

    How do i revert it? I want sorces of a logname and not a logname from a source?

    Hope you understand what i mean :)

    Samus

    2013年2月12日 15:53

回答

  • You could also do this to get all logs and their associated sources:

    Get-EventLog -LogName * |ForEach-Object {$LogName = $_.Log;Get-EventLog -LogName $LogName -ErrorAction SilentlyContinue |Select-Object @{Name= "Log Name";Expression = {$LogName}}, Source -Unique}




    Karl


    When you see answers and helpful posts, please click Vote As Helpful, Propose As Answer, and/or Mark As Answer



    My Blog: http://unlockpowershell.wordpress.com/
    My Book: Windows PowerShell 2.0 Bible
    My E-mail: -join ("6B61726C6D69747363686B65406D742E6E6574"-split"(?<=\G.{2})",19|%{[char][int]"0x$_"})




    • 編集済み Just Karl 2013年2月12日 18:06
    • 回答としてマーク Samus-Aran 2013年2月12日 22:36
    2013年2月12日 18:05

すべての返信

  • You could do this:

    Get-EventLog -LogName Application |Select-Object Source -Unique
    Karl

    When you see answers and helpful posts, please click Vote As Helpful, Propose As Answer, and/or Mark As Answer



    My Blog: http://unlockpowershell.wordpress.com
    My Book: Windows PowerShell 2.0 Bible
    My E-mail: -join ("6B61726C6D69747363686B65406D742E6E6574"-split"(?<=\G.{2})",19|%{[char][int]"0x$_"})

    • 回答の候補に設定 Pr1nz 2014年2月26日 21:25
    2013年2月12日 17:31
  • You could also do this to get all logs and their associated sources:

    Get-EventLog -LogName * |ForEach-Object {$LogName = $_.Log;Get-EventLog -LogName $LogName -ErrorAction SilentlyContinue |Select-Object @{Name= "Log Name";Expression = {$LogName}}, Source -Unique}




    Karl


    When you see answers and helpful posts, please click Vote As Helpful, Propose As Answer, and/or Mark As Answer



    My Blog: http://unlockpowershell.wordpress.com/
    My Book: Windows PowerShell 2.0 Bible
    My E-mail: -join ("6B61726C6D69747363686B65406D742E6E6574"-split"(?<=\G.{2})",19|%{[char][int]"0x$_"})




    • 編集済み Just Karl 2013年2月12日 18:06
    • 回答としてマーク Samus-Aran 2013年2月12日 22:36
    2013年2月12日 18:05
  • This worked for event logs that were in active use but for any that had not been used nothing was listed.

    Is there another way to get the actual registered sources for all the event logs rather enumerating all the event log entries for unique sources?

    2016年6月9日 14:43
  • You can find information in registery

    (Get-ChildItem HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\LogName).pschildname




    • 編集済み loicv 2016年6月27日 15:08
    • 回答の候補に設定 AM_Simon 2018年5月16日 8:16
    2016年6月27日 15:05
  • loicv's recommendation of using the registry worked well for me.  I wanted to find "registered" log sources, not ones that are found in existing event log entries.

    Only comment is that LogName in loicv's example should maybe be <LogName>, to indicate that this should be "Application" or "Security" or an actual log name.

    Thanks for the help!

    2018年1月25日 0:48