How to stream windows event log on the command line?

Question

I am looking to do the equivalent of:

tail -f

on Windows. I read this but looks like there is no way to stream the event log so it runs in an endless loop and displays events as they occur on the command-line. Is there any built-in command option/flag to do this in Windows?

Answer 1

The [System.Diagnostics.Eventing.Reader.EventLogWatcher]-based solution^[*] in stackprotector's answer is promising, but somewhat cumbersome due to requiring a temporary file that must be read separately.

This can be avoided with the following Trace-WinEvent function, which streams any newly added event records directly to the pipeline:

function Trace-WinEvent {

  param(
    [Parameter(Mandatory)] [string] $LogName
  )

  $sourceId = 'TraceWinEvent' # self-chosen
  try {
    $query = [System.Diagnostics.Eventing.Reader.EventLogQuery]::new($LogName, 'LogName')
    $watcher = [System.Diagnostics.Eventing.Reader.EventLogWatcher]::new($query)
    $watcher.Enabled = $true
    Write-Verbose "Registering for EventLogWatcher events for the '$LogName' log..."
    Register-ObjectEvent -InputObject $watcher -SourceIdentifier $sourceId -EventName EventRecordWritten
    Write-Verbose 'Waiting for such events indefinitely; use Ctrl+C to stop...'
    while ($true) {
      $evt = Wait-Event -SourceIdentifier $sourceId
      $evt | Remove-Event
      # Extract the event record.
      $evtRec = $evt.SourceEventArgs.EventRecord
      # Add a .Message NoteProperty member and output the decorated record.
      $evtRec | Add-Member -PassThru Message $evtRec.FormatDescription()
    }
  }
  finally {
    Unregister-Event $sourceId
  }
}

Invoke it, e.g., as follows:

# Trace (monitor) the Application event log for newly created records 
# and also capture them in variable $records.
# -Verbose provides verbose feedback.
# Use Ctrl-C to stop.
Trace-WinEvent Application -OutVariable records -Verbose 

Sample output:

Note:

• Streaming to the pipeline not only produces instant console output, but also allows programmatic processing of the records - which are [System.Diagnostics.Eventing.Reader.EventLogRecord] instances - in the pipeline.

• To stop tracing (monitoring), press Ctrl+C.

• The implementation is based on:

  • Calling Register-ObjectEvent without an -Action script block, which makes PowerShell queue the events for on-demand retrieval.

  • This on-demand retrieval is performed in an infinite loop that calls Wait-Event to retrieve pending events one at a time, in a blocking manner.

  • Since PowerShell's for-display formatting of EventLogRecord instances relies on the presence of a .Message ETS property (of type NoteProperty, which Get-WinEvent automatically decorates its output objects with), the above code manually decorates each instance extracted from an event object that way, via the .FormatDescription() method, and outputs the decorated instance to the pipeline.

---

^{[*] The other solution there, the Get-WinEventTail function, is best avoided, because it unconditionally outputs the last N entries every time, which will produce many duplicates that are likely to drown out the information of interest.}