Search all Evenlogs, Error when is empty

Franky 106 Reputation points
2022-10-04T13:44:10.147+00:00

Hello,

I want to search all Eventlogs. If there is no data/entry a error message is display. Is it posible to bypass the error message when eventlog is empty?

247367-image.png

$startdate = "01/01/2022 01:00:00"  # mm/tt/yyyy  
$enddate = "12/31/2022 23:590:00"  
#$Computer = "PCABD"  
  
#===========================================================================================================  
# Get all Eventlogs  
#===========================================================================================================  
  
$AllEventLogs = Get-WinEvent -ListLog Microsoft-Windows* #-ComputerName PCAF1  
foreach($EventLog in $AllEventLogs){  
  
    #Get-WinEvent -ListLog *  
    $Events = Get-WinEvent -logname $EventLog.LogName | where {$_.TimeCreated -gt $startdate -and $_.TimeCreated -lt $enddate}  
  
    foreach($event in $Events){  
        #If($event.Message -match "Suchbegriff"){  
            write-host $event.Message -ForegroundColor Green  
            $event.LogName +";"+ $event.TimeCreated +";" + $event.id +";"+ $event.LevelDisplayName + ";"+ $event.Message  >>c:\temp\EventLogTreffer.txt   
        #} # endif  
    }   
} #foreach AllEventlogs  
  
  
Windows for business | Windows Server | User experience | PowerShell
0 comments No comments
{count} votes

4 answers

Sort by: Most helpful
  1. Rich Matheisen 47,901 Reputation points
    2022-10-04T14:42:10.58+00:00

    It looks like the Get-WinEvent cmdlet writes the error message even if the ErrorAction is set to SilentlyContinue. To avoid the message being shown on the console, wrap the cmdlet and the code that follows in a Try/Catch block. You can deal with the error in the catch block if you like.

    $startdate = "01/01/2022 01:00:00"  # mm/tt/yyyy  
    $enddate = "12/31/2022 23:59:00"   # Was "12/31/2022 23:590:00"  
    #$Computer = "PCABD"  
          
    #===========================================================================================================  
    # Get all Eventlogs  
    #===========================================================================================================  
          
    $AllEventLogs = Get-WinEvent -ListLog Microsoft-Windows* #-ComputerName PCAF1  
    foreach ($EventLog in $AllEventLogs) {  
        try{  
            #Get-WinEvent -ListLog *  
            $Events = Get-WinEvent -LogName $EventLog.LogName -ErrorAction STOP  |   
                            Where-Object { $_.TimeCreated -gt $startdate -and $_.TimeCreated -lt $enddate }  
            foreach ($event in $Events) {  
                If($event.Message -match "Suchbegriff"){  
                    Write-Host $event.Message -ForegroundColor Green  
                    $event.LogName + ";" + $event.TimeCreated + ";" + $event.id + ";" + $event.LevelDisplayName + ";" + $event.Message  >>c:\junk\EventLogTreffer.txt   
                } # endif  
            }  
        }  
        catch{  
            # ignore the error  
        }  
    } #foreach AllEventlo
    

  2. MotoX80 36,401 Reputation points
    2022-10-04T16:19:48.667+00:00

    Take a look at my RecentEvents.ps1 script.

    https://learn.microsoft.com/en-us/answers/questions/102481/eventlog-madness.html

    You can use the Gridview to filter events.

    247435-image.png

    0 comments No comments

  3. Franky 106 Reputation points
    2022-10-05T05:45:04.863+00:00

    next error with try and catch - why?

    No events were found that match the specified criteria.

    247656-event.png


  4. Chris 656 Reputation points
    2022-10-05T15:32:10.05+00:00

    thank you very munch to both solution.

    the script from MotoX is very fast. I think I use this.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.