#PSTip A Faster way to open specific Event Logs

Note: This tip requires PowerShell 2.0 or above.

One of the annoyances I’m facing when working with Event logs is navigating and finding a log that is buried a few levels down the logs tree. Starting in Windows 7 we now have a ton of logs on our system. One example is the PowerShell Operational log file. Its path in the console tree is:

Event Viewer (Local)
   + Applications and Services Logs
      + Microsoft
         + Windows
            + PowerShell
              - Admin
              - Analytic
              - Debug
              - Operational

You get the picture–too many clicks just to get there! And the list of logs is so long that your eyes are starting to lost their way. I was looking for a better and shorter way to launch Event Viewer with a predefined log path specified and hoped it could open right on the log file but I couldn’t find any command line switch to do that.

Fortunately I could find a solution with PowerShell. With the Get-WinEvent cmdlet we can get a list of all event logs, including classic logs (such as the System and Application logs), and the event logs that are generated by the Windows Event Log technology introduced in Windows Vista. We can pass a log name we are interested in and even use wildcards.

PS>  Get-WinEvent -ListLog *PowerShell*
LogMode   MaximumSizeInBytes RecordCount LogName
-------   ------------------ ----------- -------
Circular            15728640        6422 Windows PowerShell
Circular             1052672           0 Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/...
Retain            1048985600           0 Microsoft-Windows-PowerShell/Admin
Circular            15728640         157 Microsoft-Windows-PowerShell/Operational

We get back several log files but I’m only interested in the Microsoft-Windows-PowerShell/Operational log file so let’s narrow down the list.

PS>  Get-WinEvent -ListLog *PowerShell/op*
LogMode   MaximumSizeInBytes RecordCount LogName
-------   ------------------ ----------- -------
Circular            15728640         157 Microsoft-Windows-PowerShell/Operational

Now that I have the log I want to view I can grab its path on the local file system and try to invoke it:

PS> $pslog = Get-WinEvent -ListLog *PowerShell/op*
PS> $pslog | Format-List log*

LogName      : Microsoft-Windows-PowerShell/Operational
LogType      : Operational
LogIsolation : Application
LogFilePath  : %SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx
LogMode      : Circular

There’s one problem though, the path starts with a DOS environment variable notation that the Invoke-Item cmdlet doesn’t understand. We can expand it with the ExpandEnvironmentVariables() method:

PS> [System.Environment]::ExpandEnvironmentVariables($pslog.LogFilePath)
C:\WINDOWS\System32\Winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx

Great, now let’s invoke the path and see what happens.

$pslog = Get-WinEvent -ListLog *PowerShell/op*
$path = [System.Environment]::ExpandEnvironmentVariables($pslog.LogFilePath)
Invoke-Item -Path $path

Excellent, right on the money! The log file is loaded and presented when Event Viewer is opened, no need to embark on a clicking adventure.

The log file was loaded under the Saved Logs folder in the Event Viewer console tree. From now on each time you open the Event Viewer, the PowerShell log file will be listed under that folder. When Event Viewer is launched it knows which files to add to the Saved Logs list by looking for XML files at a specific location on the file system. Saved Logs are saved under the C:\ProgramData system folder (hidden by default) as XML files.

To clear the list, delete the files found under that path. I’ve found that if you remove the logs via the Action menu/pane, you are removing it from the console tree and the only way to reopen the log is via Open Saved log option.

Get-ChildItem "$env:ProgramData\Microsoft\Event Viewer\ExternalLogs" -Filter *.xml |
Remove-Item -Force

Before you remove them make sure to close the Event Viewer otherwise the files will be created again when Event Viewer is closed. Note that you must run this from an elevated session or you will get an access denied error.