2

I'm trying to use Get-WinEvent to retrieve events from the eventlog for specific provider names that my company uses to write to the eventlog. I'm finding that I'm getting differing results depending on whether I use Get-WinEvent versus Get-EventLog, and I'm not sure why.

Using this test code (both provider names are proprietary names for different applications my company has):

$pName1 = "MagicFS6"
$pName2 = "MT_WPLAppServer"
$provider = $pName2

$fhash = @{
    logname      = 'application';
    providername = $provider;
    StartTime    = '8/1/2017 12:00:00 AM'
}
$fhashevent = $null
$fhashevent = Get-WinEvent -FilterHashtable $fhash
$count = $fhashevent.Count
Write-Host "$provider had $count events using Get-WinEvent"

$eventlog = Get-EventLog -LogName Application -Source $provider -After '8/1/2017 12:00:00 AM'
$count = $eventlog.Count
Write-Host "$provider had $count events using Get-EventLog"

Running with $pName1 (MagicFS6), both Get-WinEvent and Get-EventLog return the same number of events. This tells me that the code is equivalent.

However, running with $pName2 (MT_WPLAppServer), Get-WinEvent returns 0 events, and Get-EventLog correctly returns thousands of results.

Results image

MagicFS6 had 12662 events using Get-WinEvent
MagicFS6 had 12662 events using Get-EventLog

MT_WPLAppServer had 0 events using Get-WinEvent
MT_WPLAppServer had 11483 events using Get-EventLog

For my needs, I need to use Get-WinEvent, so I would love some ideas on why this is not returning reliable results.

Ansgar Wiechers
  • 193,178
  • 25
  • 254
  • 328

0 Answers0