Parsing Event Logs for FREE
summary
Shows concrete PowerShell commands and measurements: use Get-WinEvent not Get-EventLog, prefer filter-hash tables for speed, and push work to remotes — filter left — to cut runtime. Demonstrates building XML/XPath queries and using XPath/XML filters to extract event data, converting records with ToXml and parsing properties into objects (username, computer, timestamp, event type). Gives event IDs and provider templates used to map message fields, and reports the hash-table approach runs noticeably faster.
AI-written summary · about
chapters (16)
- 0:00Event log parsing intro
- 1:03Windows/PowerShell event logs
- 3:11Event log structure and XML
- 8:15Get-EventLog vs Get-WinEvent
- 12:28Listing and filtering logs
- 14:33Hash table filters
- 16:50Filter left for efficiency
- 18:57XML filters for queries
- 23:12Dynamic XPath queries
- 27:22Querying multiple servers
- 29:14Extracting event data
- 33:40Analyzing event properties
- 37:58Filter by user SID
- 40:17Event providers and templates
- 43:34Metadata from providers
- 44:59Summary and best practices
related talks
41mWhat the Log?! So Many Events, so Little Time...
47mEvent-Driven Automation with PowerShell: Listening for Change, Acting in Real Time
01h 00mBuilding your own profiling and diagnosis tools with Event Tracing for Windows
34mPowerShell Error and Event Collection at Scale
58mETW - Monitor Anything, Anytime, Anywhere
30mFast Log Analysis Made Easy by Automatically Parsing Heterogeneous Logs
53mLogging Is Hot Again
42mMake your logs work for you