EventLog

EventLog stores log information for the whole system via Event Tracing for Windows (ETW). For troubleshooting purposes, it is always important to take a dedicated look at the logs to find further information. PowerShell makes this very easy for us with two cmdlets: Get-EventLog and Get-WinEvent. Get-WinEvent is the newer cmdlet, which also allows you to retrieve events from the applications and services logs and uses server-side filtering. Get-EventLog returns objects of the type System.Diagnostics.EventLogEntry, and Get-WinEvent returns objects of the type System.Diagnostics.Eventing.Reader.EventLogRecord. There are significant differences in the properties, as the Source becomes ProviderName, the EntryType becomes LevelDisplayName, and the Category becomes TaskDisplayName. In addition, the replacement strings are only visible if the events are saved as XML. The main purpose of having the new Get-WinEvent cmdlet, though, is for performance reasons, which has been proven by many...