Command
$Depuis = (Get-Date).AddHours(-24)
Get-WinEvent -FilterHashtable @{
LogName = @('System','Application')
Level = 1,2
StartTime = $Depuis
} -ErrorAction SilentlyContinue |
Select-Object TimeCreated, LogName, Id, ProviderName, LevelDisplayName, Message |
Sort-Object TimeCreated -Descending |
Format-ListWhen to use it
Run this after a crash, unexpected restart, or application failure.
How it works
- Levels 1 and 2 correspond to critical events and errors.
- Change AddHours(-24) to adjust the time window.
Precautions
- Event logs may contain errors with no real impact; always correlate the timestamp with the reported symptom.
Rollback
Read-only operation; no rollback is required.