1

Can anyone explain to me why this command doesn’t work

But running with an -instanceid 10016 does?

Obviously records for both event id’s exist in event viewer

For 6005 it says there are no matches.

Sorry for the formatting. Phone won’t let me put text after the code block

get-eventlog -logname system -Instanceid 6005
2 Spice ups
2

short of the ID does not exist, not sure, i mean you are saying it DOES exist, ya?

Does it list them if you pull ALL event and then use a ‘where-object’ to filter it?

does ‘get-winevent’ show it?

1 Spice up
3 
Get-WinEvent -FilterHash @{LogName='system';ID=6005}

^ works

4

That did work perfectly thank you.

but it still begs the question why my command does not. I mean I don’t understand why it would search 10016 and not 6005?

5

Get-EventLog uses a Win32 API that is deprecated. The results may not be accurate missed or truncuated. Use the Get-WinEvent cmdlet instead.

get-event log shows Systeml logs – shows events that are related to the system. Restart of system, restart of services, system files, stuff like that

1 Spice up