Get-EventLog on localized Windows

Dear all,

I am using powershell 1.0 on French XP Pro SP2 and I am encountering some
problems with the Get-EventLog command.

Here is a little script I wrote :

#For each events repository...
ForEach ($eventsRepository in Get-EventLog -list) {

#Get the name of the current events repository
$local:myEventsRepositoryName = $eventsRepository.LogDisplayName

#Debug
Write-Host "Current events repository is" $myEventsRepositoryName

#Get all events from the current repository sorted by ascending Index
number and format as a list
$local:myEvents = Get-EventLog -logName $myEventsRepositoryName |
Sort-Object -property 'Index' | Format-List

#Get the export file name for this events repository
$local:myFileName = 'events-' + $myEventsRepositoryName + '.txt'

#Debug
Write-Host "Current events repository export file name is" $myFileName

#Write all events to a text file
Out-File -inputObject $myEvents -filePath $myFileName

}


This script works as it should except for two events log repositories :
"System" and "Security".

In fact, on my localized Windows, those repositories are called "Système"
and "Sécurité" and the Get-EventLog -list command gives me the followinf
result :

PS I:\> Get-EventLog -list

Max(K) Retain OverflowAction Entries Name
------ ------ -------------- ------- ----
512 7 OverwriteOlder 171 Application
512 7 OverwriteOlder 1 Sécurité
512 7 OverwriteOlder 1 875 Système
15 360 0 OverwriteAsNeeded 88 Windows PowerShell


However the Get-EventLog -LogName "Sécurité" command fails with error :

PS I:\> Get-EventLog -logName Sécurité
Get-EventLog : The event log 'Sécurité' on computer '.' does not exist.
Au niveau de ligne : 1 Caractère : 13
+ Get-EventLog <<<< -logName Sécurité

The only way to have it working is to use Security as LogName parameter :

PS I:\> Get-EventLog -logName Security

Index Time Type Source EventID Message
----- ---- ---- ------ ------- -------
1 déc. 11 12:49 Succ Security 517 Le journal d'audit a
été effacé...


So, my question is "Is it possible to have the Get-EventLog -list command to
print the internal events log repository name instead of the localized
printable one" ?


Many thanks

Try this
get-eventlog -list | select log, logdisplayname

and see if the names are different

--
Richard Siddaway
Please note that all scripts are supplied "as is" and with no warranty
Blog: http://richardsiddaway.spaces.live.com/
PowerShell User Group: http://www.get-psuguk.org.uk


"edechaux" wrote:

> Dear all,
>
> I am using powershell 1.0 on French XP Pro SP2 and I am encountering some
> problems with the Get-EventLog command.
>
> Here is a little script I wrote :
>
> #For each events repository...
> ForEach ($eventsRepository in Get-EventLog -list) {
>
> #Get the name of the current events repository
> $local:myEventsRepositoryName = $eventsRepository.LogDisplayName
>
> #Debug
> Write-Host "Current events repository is" $myEventsRepositoryName
>
> #Get all events from the current repository sorted by ascending Index
> number and format as a list
> $local:myEvents = Get-EventLog -logName $myEventsRepositoryName |
> Sort-Object -property 'Index' | Format-List
>
> #Get the export file name for this events repository
> $local:myFileName = 'events-' + $myEventsRepositoryName + '.txt'
>
> #Debug
> Write-Host "Current events repository export file name is" $myFileName
>
> #Write all events to a text file
> Out-File -inputObject $myEvents -filePath $myFileName
>
> }
>
>
> This script works as it should except for two events log repositories :
> "System" and "Security".
>
> In fact, on my localized Windows, those repositories are called "Système"
> and "Sécurité" and the Get-EventLog -list command gives me the followinf
> result :
>
> PS I:\> Get-EventLog -list
>
> Max(K) Retain OverflowAction Entries Name
> ------ ------ -------------- ------- ----
> 512 7 OverwriteOlder 171 Application
> 512 7 OverwriteOlder 1 Sécurité
> 512 7 OverwriteOlder 1 875 Système
> 15 360 0 OverwriteAsNeeded 88 Windows PowerShell
>
>
> However the Get-EventLog -LogName "Sécurité" command fails with error :
>
> PS I:\> Get-EventLog -logName Sécurité
> Get-EventLog : The event log 'Sécurité' on computer '.' does not exist.
> Au niveau de ligne : 1 Caractère : 13
> + Get-EventLog <<<< -logName Sécurité
>
> The only way to have it working is to use Security as LogName parameter :
>
> PS I:\> Get-EventLog -logName Security
>
> Index Time Type Source EventID Message
> ----- ---- ---- ------ ------- -------
> 1 déc. 11 12:49 Succ Security 517 Le journal d'audit a
> été effacé...
>
>
> So, my question is "Is it possible to have the Get-EventLog -list command to
> print the internal events log repository name instead of the localized
> printable one" ?
>
>
> Many thanks
>
>
>

Thank you very much it worked.

How did you found there is a "Log" column as it is not printed when you use
the Get-EventLog command ?

"RichS" wrote:

> Try this
> get-eventlog -list | select log, logdisplayname
>
> and see if the names are different
>
> --
> Richard Siddaway
> Please note that all scripts are supplied "as is" and with no warranty
> Blog: http://richardsiddaway.spaces.live.com/
> PowerShell User Group: http://www.get-psuguk.org.uk
>
>
> "edechaux" wrote:
>
> > Dear all,
> >
> > I am using powershell 1.0 on French XP Pro SP2 and I am encountering some
> > problems with the Get-EventLog command.
> >
> > Here is a little script I wrote :
> >
> > #For each events repository...
> > ForEach ($eventsRepository in Get-EventLog -list) {
> >
> > #Get the name of the current events repository
> > $local:myEventsRepositoryName = $eventsRepository.LogDisplayName
> >
> > #Debug
> > Write-Host "Current events repository is" $myEventsRepositoryName
> >
> > #Get all events from the current repository sorted by ascending Index
> > number and format as a list
> > $local:myEvents = Get-EventLog -logName $myEventsRepositoryName |
> > Sort-Object -property 'Index' | Format-List
> >
> > #Get the export file name for this events repository
> > $local:myFileName = 'events-' + $myEventsRepositoryName + '.txt'
> >
> > #Debug
> > Write-Host "Current events repository export file name is" $myFileName
> >
> > #Write all events to a text file
> > Out-File -inputObject $myEvents -filePath $myFileName
> >
> > }
> >
> >
> > This script works as it should except for two events log repositories :
> > "System" and "Security".
> >
> > In fact, on my localized Windows, those repositories are called "Système"
> > and "Sécurité" and the Get-EventLog -list command gives me the followinf
> > result :
> >
> > PS I:\> Get-EventLog -list
> >
> > Max(K) Retain OverflowAction Entries Name
> > ------ ------ -------------- ------- ----
> > 512 7 OverwriteOlder 171 Application
> > 512 7 OverwriteOlder 1 Sécurité
> > 512 7 OverwriteOlder 1 875 Système
> > 15 360 0 OverwriteAsNeeded 88 Windows PowerShell
> >
> >
> > However the Get-EventLog -LogName "Sécurité" command fails with error :
> >
> > PS I:\> Get-EventLog -logName Sécurité
> > Get-EventLog : The event log 'Sécurité' on computer '.' does not exist.
> > Au niveau de ligne : 1 Caractère : 13
> > + Get-EventLog <<<< -logName Sécurité
> >
> > The only way to have it working is to use Security as LogName parameter :
> >
> > PS I:\> Get-EventLog -logName Security
> >
> > Index Time Type Source EventID Message
> > ----- ---- ---- ------ ------- -------
> > 1 déc. 11 12:49 Succ Security 517 Le journal d'audit a
> > été effacé...
> >
> >
> > So, my question is "Is it possible to have the Get-EventLog -list command to
> > print the internal events log repository name instead of the localized
> > printable one" ?
> >
> >
> > Many thanks
> >
> >
> >

(get-eventlog -list) | get-member
--
Richard Siddaway
Please note that all scripts are supplied "as is" and with no warranty
Blog: http://richardsiddaway.spaces.live.com/
PowerShell User Group: http://www.get-psuguk.org.uk


"edechaux" wrote:

>
> Thank you very much it worked.
>
> How did you found there is a "Log" column as it is not printed when you use
> the Get-EventLog command ?
>
> "RichS" wrote:
>
> > Try this
> > get-eventlog -list | select log, logdisplayname
> >
> > and see if the names are different
> >
> > --
> > Richard Siddaway
> > Please note that all scripts are supplied "as is" and with no warranty
> > Blog: http://richardsiddaway.spaces.live.com/
> > PowerShell User Group: http://www.get-psuguk.org.uk
> >
> >
> > "edechaux" wrote:
> >
> > > Dear all,
> > >
> > > I am using powershell 1.0 on French XP Pro SP2 and I am encountering some
> > > problems with the Get-EventLog command.
> > >
> > > Here is a little script I wrote :
> > >
> > > #For each events repository...
> > > ForEach ($eventsRepository in Get-EventLog -list) {
> > >
> > > #Get the name of the current events repository
> > > $local:myEventsRepositoryName = $eventsRepository.LogDisplayName
> > >
> > > #Debug
> > > Write-Host "Current events repository is" $myEventsRepositoryName
> > >
> > > #Get all events from the current repository sorted by ascending Index
> > > number and format as a list
> > > $local:myEvents = Get-EventLog -logName $myEventsRepositoryName |
> > > Sort-Object -property 'Index' | Format-List
> > >
> > > #Get the export file name for this events repository
> > > $local:myFileName = 'events-' + $myEventsRepositoryName + '.txt'
> > >
> > > #Debug
> > > Write-Host "Current events repository export file name is" $myFileName
> > >
> > > #Write all events to a text file
> > > Out-File -inputObject $myEvents -filePath $myFileName
> > >
> > > }
> > >
> > >
> > > This script works as it should except for two events log repositories :
> > > "System" and "Security".
> > >
> > > In fact, on my localized Windows, those repositories are called "Système"
> > > and "Sécurité" and the Get-EventLog -list command gives me the followinf
> > > result :
> > >
> > > PS I:\> Get-EventLog -list
> > >
> > > Max(K) Retain OverflowAction Entries Name
> > > ------ ------ -------------- ------- ----
> > > 512 7 OverwriteOlder 171 Application
> > > 512 7 OverwriteOlder 1 Sécurité
> > > 512 7 OverwriteOlder 1 875 Système
> > > 15 360 0 OverwriteAsNeeded 88 Windows PowerShell
> > >
> > >
> > > However the Get-EventLog -LogName "Sécurité" command fails with error :
> > >
> > > PS I:\> Get-EventLog -logName Sécurité
> > > Get-EventLog : The event log 'Sécurité' on computer '.' does not exist.
> > > Au niveau de ligne : 1 Caractère : 13
> > > + Get-EventLog <<<< -logName Sécurité
> > >
> > > The only way to have it working is to use Security as LogName parameter :
> > >
> > > PS I:\> Get-EventLog -logName Security
> > >
> > > Index Time Type Source EventID Message
> > > ----- ---- ---- ------ ------- -------
> > > 1 déc. 11 12:49 Succ Security 517 Le journal d'audit a
> > > été effacé...
> > >
> > >
> > > So, my question is "Is it possible to have the Get-EventLog -list command to
> > > print the internal events log repository name instead of the localized
> > > printable one" ?
> > >
> > >
> > > Many thanks
> > >
> > >
> > >

Great. Thank you for all.

"RichS" wrote:

> (get-eventlog -list) | get-member
> --
> Richard Siddaway
> Please note that all scripts are supplied "as is" and with no warranty
> Blog: http://richardsiddaway.spaces.live.com/
> PowerShell User Group: http://www.get-psuguk.org.uk
>
>
> "edechaux" wrote:
>
> >
> > Thank you very much it worked.
> >
> > How did you found there is a "Log" column as it is not printed when you use
> > the Get-EventLog command ?
> >
> > "RichS" wrote:
> >
> > > Try this
> > > get-eventlog -list | select log, logdisplayname
> > >
> > > and see if the names are different
> > >
> > > --
> > > Richard Siddaway
> > > Please note that all scripts are supplied "as is" and with no warranty
> > > Blog: http://richardsiddaway.spaces.live.com/
> > > PowerShell User Group: http://www.get-psuguk.org.uk
> > >
> > >
> > > "edechaux" wrote:
> > >
> > > > Dear all,
> > > >
> > > > I am using powershell 1.0 on French XP Pro SP2 and I am encountering some
> > > > problems with the Get-EventLog command.
> > > >
> > > > Here is a little script I wrote :
> > > >
> > > > #For each events repository...
> > > > ForEach ($eventsRepository in Get-EventLog -list) {
> > > >
> > > > #Get the name of the current events repository
> > > > $local:myEventsRepositoryName = $eventsRepository.LogDisplayName
> > > >
> > > > #Debug
> > > > Write-Host "Current events repository is" $myEventsRepositoryName
> > > >
> > > > #Get all events from the current repository sorted by ascending Index
> > > > number and format as a list
> > > > $local:myEvents = Get-EventLog -logName $myEventsRepositoryName |
> > > > Sort-Object -property 'Index' | Format-List
> > > >
> > > > #Get the export file name for this events repository
> > > > $local:myFileName = 'events-' + $myEventsRepositoryName + '.txt'
> > > >
> > > > #Debug
> > > > Write-Host "Current events repository export file name is" $myFileName
> > > >
> > > > #Write all events to a text file
> > > > Out-File -inputObject $myEvents -filePath $myFileName
> > > >
> > > > }
> > > >
> > > >
> > > > This script works as it should except for two events log repositories :
> > > > "System" and "Security".
> > > >
> > > > In fact, on my localized Windows, those repositories are called "Système"
> > > > and "Sécurité" and the Get-EventLog -list command gives me the followinf
> > > > result :
> > > >
> > > > PS I:\> Get-EventLog -list
> > > >
> > > > Max(K) Retain OverflowAction Entries Name
> > > > ------ ------ -------------- ------- ----
> > > > 512 7 OverwriteOlder 171 Application
> > > > 512 7 OverwriteOlder 1 Sécurité
> > > > 512 7 OverwriteOlder 1 875 Système
> > > > 15 360 0 OverwriteAsNeeded 88 Windows PowerShell
> > > >
> > > >
> > > > However the Get-EventLog -LogName "Sécurité" command fails with error :
> > > >
> > > > PS I:\> Get-EventLog -logName Sécurité
> > > > Get-EventLog : The event log 'Sécurité' on computer '.' does not exist.
> > > > Au niveau de ligne : 1 Caractère : 13
> > > > + Get-EventLog <<<< -logName Sécurité
> > > >
> > > > The only way to have it working is to use Security as LogName parameter :
> > > >
> > > > PS I:\> Get-EventLog -logName Security
> > > >
> > > > Index Time Type Source EventID Message
> > > > ----- ---- ---- ------ ------- -------
> > > > 1 déc. 11 12:49 Succ Security 517 Le journal d'audit a
> > > > été effacé...
> > > >
> > > >
> > > > So, my question is "Is it possible to have the Get-EventLog -list command to
> > > > print the internal events log repository name instead of the localized
> > > > printable one" ?
> > > >
> > > >
> > > > Many thanks
> > > >
> > > >
> > > >