CODEWITHSUNDEEP
powershellwindows-server-2003
gjjhhh_
gjjhhh_

Reputation: 169

How do I use Get-EventLog to get the same result of Get-WinEvent in PowerShell?

I am working on Windows Server 2003 and I need to get something like the following by using this command Get-WinEvent -ListLog Application, Security, System

LogMode   MaximumSizeInBytes RecordCount LogName
-------   ------------------ ----------- -------
Circular            33554432       15188 Application
Circular           201326592      298459 Security
Circular            33554432       10074 System

I need the result of the property MaximumSizeInBytes but Get-WinEvent is not supported on Server 2003

I see that Get-EventLog has a property called MaximumKilobytes but the result I get is different

I would like to know if there is a command can be ran locally to get the same result

Upvotes: 0

Views: 244

Answers (2)

gjjhhh_
gjjhhh_

Reputation: 169

As no one has provided a satisfying answer yet I will just post the answer I found online here. The following command saved my life:

Get-WmiObject -Class Win32_NTEventLogFile | Select-Object -Property MaxFileSize, LogfileName, Name, NumberOfRecords

I will not choose my own answer as the final answer just yet so if you can think of a better solution please feel free to add it :)

Thank you for viewing my post and tried to help

Upvotes: 0

postanote
postanote

Reputation: 16076

First why are you still on WS2K3? --- ;-} Before you respond, I know, I know, some orgs... right!? ;-}

Yet, unless someone on this site has WS2K3, there is no way for them to validate stuff.

This cmdlet not supported on WS2K3 is not a bug or missing thing. cmdlets are OS version and PowerShell version specific.

All that being said. Just because a command does not exist on your system, does not mean you cannot try use it.

This is why implicit PSRemoting exists.

Remoting the Implicit Way

Using implicit PowerShell remoting to import remote modules

Mostly you see this used for ADDS, Exchange, O365 cmdlets and the like, but you can do it for any module / cmdlet on a remote host to use on your local session. Using implicit remoting the cmdlet really does not run on your system it is proxied. Just be sure to use the -prefix argument so to not end up with duplicate cmdlets being listed.

Example

$RemoteSession = New-PSSession -ComputerName 'RemoteHost' -Credential (Get-Credential -Credential "$env:USERDOMAIN\$env:USERNAME")
Import-PSSession -Session $RemoteSession -Prefix RS

So, no you call the cmdlets using the prefix when you want to use one from that session.

Get-RSWinEvent

Now, as I said, I have no WS2K3 boxes to mess with as I am all WS2K12R2/16/19. Yet, give it a shot.

Upvotes: 1

Related Questions