Powershell get-eventlog very time consuming

How long does it take for a single server?
I mean if C:\ADMS1_Servers.txt contains a single server.

ive tried that, it takes forever, I just gave up in the end.

OK. This:

Get-EventLog -LogName system -After 2/17/2014 | where {$_.eventid -eq "11"}

Select allOpen in new window

returned results after 1 second.

Make sure your locale is correct. On my system 17/02/2014 threw an error

HTH,
Dan

that im sure is correct as our systems are on the UK format :)

You might see an improvement if you allow Get-EventLog to manage the PCs itself, or use Get-WinEvent -FilterHashTable (which allows for filtering for an event id):

Get-EventLog -Computer (get-content C:\ADMS1_Servers.txt) -LogName system -After 17/02/2014 | where {$_.eventid -eq "11"} }  | ft * -auto
Get-WinEvent -Computer (get-content C:\ADMS1_Servers.txt)  -FilterHashTable @{
  logname = 'system'
  ID = 11
  StartTime = 17/02/2014
} | ft * -auto

Select allOpen in new window

(Dates in UK format of dd/mm/yyyy).

HI Qlemo,

The get-eventlog still takes very, I can't even cancel out of it by pressing cntrl + c.

The get-winevent doesn't work, its gives me this error message:

Get-WinEvent : Cannot convert 'System.Object[]' to the type 'System.String' required by parameter 'Co
fied method is not supported.
At line:1 char:23
+ Get-WinEvent -Computer <<<<  (get-content C:\ADMS1_Windows_Servers.txt)  -FilterHashTable @{
    + CategoryInfo          : InvalidArgument: (:) [Get-WinEvent], ParameterBindingException
    + FullyQualifiedErrorId : CannotConvertArgument,Microsoft.PowerShell.Commands.GetWinEventCommand

Thanks for your help :)

Oh, that's true, Get-WinEvent does not allow for a string array for -ComputerName ...

get-content C:\ADMS1_Servers.txt | % {
  Get-WinEvent -Computer $_  -FilterHashTable @{
    logname = 'system'
    ID = 11
    StartTime = 17/02/2014
}} | ft * -auto

Select allOpen in new window

HI Guys,

I tried this code below:

Get-EventLog -Computer (get-content C:\ADMS1_Windows_Servers.txt) -LogName system -After 17/02/2014 | where {$_.eventid -match "7|11|51|52"}   | ft * -auto

Select allOpen in new window

However the -match gives me anything with a 7 or 11 e.g  00711 or 1231144? How can I get it to match only the number I've specified?

Also it takes ages, I let it running all night then when I came back tomorrow morning and it was still running, then I pressed cntrl + c , then it gave me some results.