Win32_NTEventlogFile

To get a list of log files available on your local computer:

Get-WmiObject -class Win32_NTEventlogFile | Format-Table –wrap

 

To access the log files on a remote computer:

Get-WmiObject -computerName RemoteHostName -class Win32_NTEventlogFile | select FileSize, LogfileName, Name, NumberOfRecords, CSName | Format-Table –wrap

 

To get a list of the log files that contain the last 100 entries on the local computer:

Get-WmiObject –namespace root\CIMV2 -class Win32_NTLogEvent | Select-Object LogFile –last 100 -unique

 

To get a list of log files that contain the last 100 entries on the remote computer:

Get-WmiObject –computerName RemoteHostName –namespace root\CIMV2 -class Win32_NTLogEvent | Select-Object LogFile –last 100 –unique

 

To Increase the value of MemoryPerHost when encounterring the error "Quota violation":

1. Select Start => Run and type wbemtest.exe.
2. Click Connect on theWindows Management Instrumentation Tester.
3. In the Namespace text box, just enter root. Click Connect.
4. Select Enum Instances.

5. In the Class Info dialog, enter the superclass name as __ProviderHostQuotaConfiguration
and click OK.
6. In the Query Result window, double-click _ProviderHostQuotaConfiguration=@.
7. In the Object Editor window, under Properties, find the property MemoryPerHost and double-click it.
8. Increase the value and select Save Property. Close the windows and restart the machine.

 

To query all of the entries in the Application event log:

Get-WmiObject -namespace root\CIMV2 -class Win32_NTLogEvent -filter "LogFile='Application'"

Get-WmiObject -namespace root\CIMV2 -query "Select * from Win32_NTLogEvent where LogFile='Application'"

 

To see all the properties of instances of the Win32 NTLogEvent class:

Get-WmiObject -namespace root\CIMV2 -class Win32_NTLogEvent | Select-Object -last 1 | Get-Member –MemberType Property

 

To find all the types of events available in the Application event log on the local computer by querying EventType and type:

Get-WmiObject -namespace root\CIMV2 -class Win32_NTLogEvent -Filter "LogFile='Application'" | Select-Object EventType, Type -unique | Sort-Object EventType

 

To look at the error events generated by the default SQL Server instance in the Application log:

Get-WmiObject -namespace root\CIMV2 -class Win32_NTLogEvent | Where-Object { ($_.LogFile -eq 'Application') -and ($_.SourceName -eq "MSSQLSERVER") -and ($_.EventType -eq 1) } | Format-List SourceName, Message, TimeGenerated 

 

To filter events based on date ranges:

Get-WmiObject -namespace root\CIMV2 -class Win32_NTLogEvent -Filter "LogFile='Application'" | Where-Object { ($_.EventType -eq 1) –and ($_.TimeGenerated -gt "20111130") -and ($_.TimeGenerated –lt "20111201") } | Sort-Object TimeGenerated -descending | Format-List