Behind the PowerShell Pipeline logo

Behind the PowerShell Pipeline

Subscribe
Archives
October 20, 2022

Eventing Event Logs with PowerShell

I thought I was finished covering eventing with PowerShell, but a recent message on Twitter led to one final article. The question was about watching for new entries in an event log. This is a perfect use case and is right in the name. When some event occurs, it is recorded. The question from Twitter was about watching events without using WMI or CIM. First, let’s look at how you would use WMI or CIM.

Win32_NTLogEvent

You can use the system __InstanceCreationEvent class. Use the Win32_NTLogEvent class to watch for new event entries.

$query = "Select * from __InstanceCreationEvent within 10 WHERE TargetInstance ISA 'Win32_NTLogEvent'"
Register-CimIndicationEvent -Query $query -MessageData "An event was logged" -SourceIdentifier "WatchEventLog"
Want to read the full issue?
GitHub Bluesky LinkedIn About Jeff
Powered by Buttondown, the easiest way to start and grow your newsletter.