Windows 10: How to export Event Viewer logs in Windows 11/10

​

Event Viewer in Windows creates a record of events that occurred on your computer. So, let’s say an application fails to start for some reason; the Event Viewer will capture it and create a log. In this post, we will see how you can export Event Viewer logs. Export Event Viewer Logs in Windows 11/10 […]

This article How to export Event Viewer logs in Windows 11/10 first appeared on TheWindowsClub.com.

read more...

 

Export All Administrative Events to Excel

To analyze events, from the Windows Event Viewer, there is a simple way to export all Administrative Events to Excel, with PowerShell.

Exporting all Administrative Events to Excel is a simple two Step process, as described here:

Step 1 - Create the Administrative Events View .xml file

1. Open Eventviewer (%windir%\system32\eventvwr.msc)
2. Navigate to: Event Viewer (Local) > Custom Views > Administrative Events
3. In the “Actions” pane select “Filter Current Custom View”.
4. Select the the XML tab.
5. Press Ctrl+A to select all the XML code of the Custom View.
6. Open a notepad, paste the selected code and save the file to your Desktop as AdmEvtView.xml

Step 2 - Create the csv file with the events

1. Download the ExportEvtCSV.zip file, which contains the script ExportEvtCSV.ps1 and unzip it, on your Desktop.
   It's not a fancy script, just basic PowerShell commands to create a csv file on the Desktop.
2. In Windows Search, type “ISE” (without the quotes) to open “Windows PowerShell ISE” and Run as administrator
   
3. To allow running the script, change the ExecutionPolicy, for this session. To do that, in the Console pane type:
   Code:
4. In the Windows PowerShell ISE, open and run the script: ExportEvtCSV.ps1
   The script will create a csv file with a name YYYYMMDD.HHMM.csv on the Desktop
5. When done, open the newly created .csv file, format the columns as needed and optionally save it as .xlsx, if you wish.

That’s it! You now have all the Administrative Events in Excel for filtering and further analysis.

Now to the more technical hard stuff... *Confused

There is a reason for running the script from within PowerShell ISE!

It would be great if everything was also working perfectly, when running the script from an elevated PowerShell too.

We can run it from an elevated PowerShell, which means that you just follow the Step 1, as above but for the Step 2 instead of the ISE you run the script from an elevated PowerShell.

The problem is that it will work only for anybody who has en-US format for the dates. Everyone else, who has another format (i.e. en-GB, fr-FR, el-GR etc.), the dates are not translated properly by Excel (although the script uses the –UseCulture switch) and remain as text in the en-US format.

I'm not sure if this a bug of the "export-csv" cmdlet, but although it runs the way it supposed to from within the ISE, from PowerShell there is a problem with the dates format.
As I haven’t found a way to overcome this obstacle, any suggestion from the PowerShell gurus of the forum (like my good friend Shawn @Brink, for instance), is welcome.

 

Error in Event Viewer

Hi,



Thank you for writing to Microsoft Community Forums.



As you have mentioned, you have performed a repair installation on the computer and you see Event 508, 510 and 533 in Event Viewer.



I would like to inform that if you see any critical error in Event Viewer, please share the event logs with us to help you with the appropriate troubleshooting steps. Please follow the steps mentioned below to share the event logs:

1. Press Windows + X from the keyboard, select
   Event Viewer.
   
2. Expand Windows Logs from the left pane and select
   Applications.
   
3. Click Filter Current Log from extreme right pane. Then in the new windows check the box beside
   Error and click OK.
   
4. Now, look for a critical Error in the list and note down the message/information from the
   General Tab in the lower section.
   

Please reply with the status of the issue, we will be glad to help you further.



Regards,

Nikhar Khare

Microsoft Community - Moderator

 

Clear All Event Logs in Event Viewer in Windows  


FWIW CCleaner will clear the Event Viewer Logs - just check the box under Windows>Advanced>Windows Events Logs. run CCleaner and it's that simple. Much faster than most ,bat files I've tried. Just a suggestion.