How do I read recent Windows server errors with PowerShell?
Use Get-WinEvent with a time range and severity filter to investigate a specific incident. Start with System or Application events related to the symptom, then correlate timestamps with the application and any provider incident.
Instructions
1. Read recent System warnings and errors
This example limits the query to the last two hours and the latest fifty matching events.
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=(Get-Date).AddHours(-2); Level=2,3} -MaxEvents 50 | Select-Object TimeCreated, Id, ProviderName, LevelDisplayName, MessageLevel 2 selects errors and level 3 selects warnings. This is a read-only query; it does not clear the log.
2. Query the relevant application log
For an application-specific problem, repeat the filter with LogName set to Application or the documented application channel. Use a narrower provider or event ID when the first results establish what to investigate.
3. Preserve context carefully
Record the time zone, event ID, provider and a redacted message. Events can contain usernames, paths, addresses or application data. A single warning may be incidental, so compare its timing and recurrence with the observed failure.
Check the result
- The event window overlaps the reported incident.
- The collected messages explain a relevant failure or identify the next specific diagnostic step.
Troubleshooting
- No matching events are found
- Check the time range, correct channel and whether the event level filter is too restrictive.
- Access is denied
- Some channels require elevated rights. Use an authorised administrative session without changing log permissions.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.