GetEventLogCommand GetEventLogCommand GetEventLogCommand Class

Definition

This class implements the Get-EventLog command

public sealed class GetEventLogCommand : System.Management.Automation.PSCmdlet
type GetEventLogCommand = class
    inherit PSCmdlet
Public NotInheritable Class GetEventLogCommand
Inherits PSCmdlet
Inheritance

Remarks

The CLR EventLogEntryCollection class has problems with managing

rapidly spinning logs (i.e. logs set to "Overwrite" which are

rapidly getting new events and discarding old events).

In particular, if you enumerate forward

EventLogEntryCollection entries = log.Entries;

foreach (EventLogEntry entry in entries)

it will occasionally skip an entry. Conversely, if you are

enumerating backward

EventLogEntryCollection entries = log.Entries;

int count = entries.Count;

for (int i = count-1; i >= 0; i--) {

    EventLogEntry entry = entries[i];

it will occasionally repeat an entry. Accordingly, we enumerate

backward and try to leave off the repeated entries.

Constructors

GetEventLogCommand() GetEventLogCommand() GetEventLogCommand()

Properties

After After After

Return entries "after " this date.

AsBaseObject AsBaseObject AsBaseObject

returns Log Entry as base object

AsString AsString AsString

Return the log names rather than the EventLog objects

Before Before Before

Return entries "Before" this date.

CommandOrigin CommandOrigin CommandOrigin

This property tells you if you were being invoked inside the runspace or if it was an external request.

(Inherited from InternalCommand)
CommandRuntime CommandRuntime CommandRuntime

Holds the command runtime object for this command. This object controls what actually happens when a write is called.

(Inherited from Cmdlet)
ComputerName ComputerName ComputerName

Read eventlog entries from this computer

CurrentPSTransaction CurrentPSTransaction CurrentPSTransaction

Gets an object that surfaces the current PowerShell transaction. When this object is disposed, PowerShell resets the active transaction

(Inherited from Cmdlet)
EntryType EntryType EntryType

match eventlog entries by the EntryType gets or sets an array of EntryTypes

Events Events Events

Gets the event manager for the current runspace.

(Inherited from PSCmdlet)
Host Host Host

Gets the host interaction APIs.

(Inherited from PSCmdlet)
Index Index Index

match eventlog entries by the Index gets or sets an array of indexes

InstanceId InstanceId InstanceId

match eventlog entries by the InstanceIds gets or sets an array of instanceIds

InvokeCommand InvokeCommand InvokeCommand

Provides access to utility routines for executing scripts and creating script blocks.

(Inherited from PSCmdlet)
InvokeProvider InvokeProvider InvokeProvider

Gets the instance of the provider interface APIs for the current runspace.

(Inherited from PSCmdlet)
JobManager JobManager JobManager

Manager for JobSourceAdapters registered.

(Inherited from PSCmdlet)
JobRepository JobRepository JobRepository

Repostiory for jobs

(Inherited from PSCmdlet)
List List List

Return the Eventlog objects rather than the log contents

LogName LogName LogName

Read eventlog entries from this log

Message Message Message

Get or Set Message string to searched in EventLog

MyInvocation MyInvocation MyInvocation

Contains information about the identity of this cmdlet and how it was invoked.

(Inherited from PSCmdlet)
Newest Newest Newest

Read only this number of entries

PagingParameters PagingParameters PagingParameters

If the cmdlet declares paging support (via SupportsPaging), then PagingParameters property contains arguments of the paging parameters. Otherwise PagingParameters property is null.

(Inherited from PSCmdlet)
ParameterSetName ParameterSetName ParameterSetName

The name of the parameter set in effect.

(Inherited from PSCmdlet)
SessionState SessionState SessionState

Gets the instance of session state for the current runspace.

(Inherited from PSCmdlet)
Source Source Source

get or sets an array of Source

Stopping Stopping Stopping

Is this command stopping?

(Inherited from Cmdlet)
UserName UserName UserName

Return entries for this user.Wild characters is supported.

Methods

BeginProcessing() BeginProcessing() BeginProcessing()

When overridden in the derived class, performs initialization of command execution. Default implementation in the base class just returns.

(Inherited from Cmdlet)
CurrentProviderLocation(String) CurrentProviderLocation(String) CurrentProviderLocation(String) Inherited from PSCmdlet
EndProcessing() EndProcessing() EndProcessing()

When overridden in the derived class, performs clean-up after the command execution. Default implementation in the base class just returns.

(Inherited from Cmdlet)
GetResolvedProviderPathFromPSPath(String, ProviderInfo) GetResolvedProviderPathFromPSPath(String, ProviderInfo) GetResolvedProviderPathFromPSPath(String, ProviderInfo) Inherited from PSCmdlet
GetResourceString(String, String) GetResourceString(String, String) GetResourceString(String, String)

Gets the resource string corresponding to baseName and resourceId from the current assembly. You should override this if you require a different behavior.

(Inherited from Cmdlet)
GetUnresolvedProviderPathFromPSPath(String) GetUnresolvedProviderPathFromPSPath(String) GetUnresolvedProviderPathFromPSPath(String) Inherited from PSCmdlet
GetVariableValue(String) GetVariableValue(String) GetVariableValue(String) Inherited from PSCmdlet
GetVariableValue(String, Object) GetVariableValue(String, Object) GetVariableValue(String, Object) Inherited from PSCmdlet
Invoke() Invoke() Invoke()

Invoke this cmdlet object returning a collection of results.

(Inherited from Cmdlet)
Invoke<T>() Invoke<T>() Invoke<T>()

Returns a strongly-typed enumerator for the results of this cmdlet.

(Inherited from Cmdlet)
ProcessRecord() ProcessRecord() ProcessRecord()

When overridden in the derived class, performs execution of the command.

(Inherited from Cmdlet)
ShouldContinue(String, String) ShouldContinue(String, String) ShouldContinue(String, String)

Confirm an operation or grouping of operations with the user. This differs from ShouldProcess in that it is not affected by preference settings or command-line parameters, it always does the query. This variant only offers Yes/No, not YesToAll/NoToAll.

(Inherited from Cmdlet)
ShouldContinue(String, String, Boolean, Boolean) ShouldContinue(String, String, Boolean, Boolean) ShouldContinue(String, String, Boolean, Boolean)

Confirm an operation or grouping of operations with the user. This differs from ShouldProcess in that it is not affected by preference settings or command-line parameters, it always does the query. This variant offers Yes, No, YesToAll and NoToAll.

(Inherited from Cmdlet)
ShouldContinue(String, String, Boolean, Boolean, Boolean) ShouldContinue(String, String, Boolean, Boolean, Boolean) ShouldContinue(String, String, Boolean, Boolean, Boolean)

Confirm an operation or grouping of operations with the user. This differs from ShouldProcess in that it is not affected by preference settings or command-line parameters, it always does the query. This variant offers Yes, No, YesToAll and NoToAll.

(Inherited from Cmdlet)
ShouldProcess(String) ShouldProcess(String) ShouldProcess(String)

Confirm the operation with the user. Cmdlets which make changes (e.g. delete files, stop services etc.) should call ShouldProcess to give the user the opportunity to confirm that the operation should actually be performed.

(Inherited from Cmdlet)
ShouldProcess(String, String) ShouldProcess(String, String) ShouldProcess(String, String)

Confirm the operation with the user. Cmdlets which make changes (e.g. delete files, stop services etc.) should call ShouldProcess to give the user the opportunity to confirm that the operation should actually be performed.

This variant allows the caller to specify text for both the target resource and the action.

(Inherited from Cmdlet)
ShouldProcess(String, String, String) ShouldProcess(String, String, String) ShouldProcess(String, String, String)

Confirm the operation with the user. Cmdlets which make changes (e.g. delete files, stop services etc.) should call ShouldProcess to give the user the opportunity to confirm that the operation should actually be performed.

This variant allows the caller to specify the complete text describing the operation, rather than just the name and action.

(Inherited from Cmdlet)
ShouldProcess(String, String, String, ShouldProcessReason) ShouldProcess(String, String, String, ShouldProcessReason) ShouldProcess(String, String, String, ShouldProcessReason)

Confirm the operation with the user. Cmdlets which make changes (e.g. delete files, stop services etc.) should call ShouldProcess to give the user the opportunity to confirm that the operation should actually be performed.

This variant allows the caller to specify the complete text describing the operation, rather than just the name and action.

(Inherited from Cmdlet)
StopProcessing() StopProcessing() StopProcessing()

When overridden in the derived class, interrupts currently running code within the command. It should interrupt BeginProcessing, ProcessRecord, and EndProcessing. Default implementation in the base class just returns.

(Inherited from Cmdlet)
ThrowTerminatingError(ErrorRecord) ThrowTerminatingError(ErrorRecord) ThrowTerminatingError(ErrorRecord)

Terminate the command and report an error

(Inherited from Cmdlet)
TransactionAvailable() TransactionAvailable() TransactionAvailable()

Returns true if a transaction is available and active.

(Inherited from Cmdlet)
WriteCommandDetail(String) WriteCommandDetail(String) WriteCommandDetail(String)

Write text into pipeline execution log.

(Inherited from Cmdlet)
WriteDebug(String) WriteDebug(String) WriteDebug(String)

Display debug information

(Inherited from Cmdlet)
WriteError(ErrorRecord) WriteError(ErrorRecord) WriteError(ErrorRecord)

Internal variant: Writes the specified error to the error pipe.

(Inherited from Cmdlet)
WriteInformation(InformationRecord) WriteInformation(InformationRecord) WriteInformation(InformationRecord)

Route information to the user or host.

(Inherited from Cmdlet)
WriteInformation(Object, String[]) WriteInformation(Object, String[]) WriteInformation(Object, String[])

Route information to the user or host.

(Inherited from Cmdlet)
WriteObject(Object) WriteObject(Object) WriteObject(Object)

Writes the object to the output pipe.

(Inherited from Cmdlet)
WriteObject(Object, Boolean) WriteObject(Object, Boolean) WriteObject(Object, Boolean)

Writes one or more objects to the output pipe. If the object is a collection and the enumerateCollection flag is true, the objects in the collection will be written individually.

(Inherited from Cmdlet)
WriteProgress(ProgressRecord) WriteProgress(ProgressRecord) WriteProgress(ProgressRecord)

Display progress information

(Inherited from Cmdlet)
WriteVerbose(String) WriteVerbose(String) WriteVerbose(String)

Display verbose information

(Inherited from Cmdlet)
WriteWarning(String) WriteWarning(String) WriteWarning(String)

Display warning information

(Inherited from Cmdlet)

Applies to